From 72fecb56d4154104348a33329eddb578815c1ec80f78c590e1ca9ecfcd743909 Mon Sep 17 00:00:00 2001 From: Antonio Larrosa Date: Tue, 17 Jan 2023 10:31:30 +0000 Subject: [PATCH] Accepting request 1058858 from home:alarrosa:branches:multimedia:libs - Add patch from upstream to avoid division by 0 and other issues with invalid values (glfo#pipewire/pipewire#2953): * 0001-alsa-guard-against-some-invalid-values.patch - Add patch from upstream to fix causing an overflow resulting in choppy sound in some cases (glfo#pipewire/pipewire#2680): * 0001-spa-Fix-audioconvert-overflow-when-scaling.patch - Add patch from upstream to fix a crash on arm: * 0001-cpu-arm-Fix-incorrect-free.patch (glfo#pipewire/pipewire#2914) suspended, were kept suspended on a rate change. (glfo#pipewire/pipewire#2929) rates were allowed. (glfo#pipewire/pipewire#2925) (glfo#pipewire/pipewire#2891) properties. (glfo#pipewire/pipewire#2933) echo-cancel. (glfo#pipewire/pipewire#2939) (glfo#pipewire/pipewire#1599) fail. This caused problems for espeak. (glfo#pipewire/pipewire#2928) set to -1. (glfo#pipewire/pipewire#2893) OBS-URL: https://build.opensuse.org/request/show/1058858 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/pipewire?expand=0&rev=106 --- ...sa-guard-against-some-invalid-values.patch | 70 +++++++++++++++++ 0001-cpu-arm-Fix-incorrect-free.patch | 70 +++++++++++++++++ ...x-audioconvert-overflow-when-scaling.patch | 75 +++++++++++++++++++ pipewire.changes | 36 ++++++--- pipewire.spec | 9 +++ 5 files changed, 251 insertions(+), 9 deletions(-) create mode 100644 0001-alsa-guard-against-some-invalid-values.patch create mode 100644 0001-cpu-arm-Fix-incorrect-free.patch create mode 100644 0001-spa-Fix-audioconvert-overflow-when-scaling.patch diff --git a/0001-alsa-guard-against-some-invalid-values.patch b/0001-alsa-guard-against-some-invalid-values.patch new file mode 100644 index 0000000..252f80e --- /dev/null +++ b/0001-alsa-guard-against-some-invalid-values.patch @@ -0,0 +1,70 @@ +From 32a7c85c84e419636109eb5db127292e25462a38 Mon Sep 17 00:00:00 2001 +From: Wim Taymans +Date: Mon, 16 Jan 2023 16:05:17 +0100 +Subject: [PATCH] alsa: guard against some invalid values + +Avoid division by 0 and other strange things when invalid values +are detected. + +Fixes #2953 +--- + spa/plugins/alsa/alsa-pcm.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/spa/plugins/alsa/alsa-pcm.c b/spa/plugins/alsa/alsa-pcm.c +index 76fe433b8..08b9ceddd 100644 +--- a/spa/plugins/alsa/alsa-pcm.c ++++ b/spa/plugins/alsa/alsa-pcm.c +@@ -1519,6 +1519,11 @@ int spa_alsa_set_format(struct state *state, struct spa_audio_info *fmt, uint32_ + fmt->info.raw.rate = rrate; + match = false; + } ++ if (rchannels == 0 || rrate == 0) { ++ spa_log_error(state->log, "%s: invalid channels:%d or rate:%d", ++ state->props.device, rchannels, rrate); ++ return -EIO; ++ } + + state->format = rformat; + state->channels = rchannels; +@@ -1563,6 +1568,11 @@ int spa_alsa_set_format(struct state *state, struct spa_audio_info *fmt, uint32_ + + CHECK(snd_pcm_hw_params_set_period_size_near(hndl, params, &period_size, &dir), "set_period_size_near"); + ++ if (period_size == 0) { ++ spa_log_error(state->log, "%s: invalid period_size 0 (driver error?)", state->props.device); ++ return -EIO; ++ } ++ + state->period_frames = period_size; + + if (state->default_period_num != 0) { +@@ -1578,6 +1588,10 @@ int spa_alsa_set_format(struct state *state, struct spa_audio_info *fmt, uint32_ + CHECK(snd_pcm_hw_params_set_buffer_size_near(hndl, params, &state->buffer_frames), "set_buffer_size_near"); + periods = state->buffer_frames / period_size; + } ++ if (state->buffer_frames == 0) { ++ spa_log_error(state->log, "%s: invalid buffer_frames 0 (driver error?)", state->props.device); ++ return -EIO; ++ } + + state->headroom = state->default_headroom; + if (is_batch) +@@ -2542,6 +2556,14 @@ int spa_alsa_start(struct state *state) + state->duration = 1024; + state->rate_denom = state->rate; + } ++ if (state->rate_denom == 0) { ++ spa_log_error(state->log, "%s: unset rate_denom", state->props.device); ++ return -EIO; ++ } ++ if (state->duration == 0) { ++ spa_log_error(state->log, "%s: unset duration", state->props.device); ++ return -EIO; ++ } + + state->following = is_following(state); + setup_matching(state); +-- +GitLab + diff --git a/0001-cpu-arm-Fix-incorrect-free.patch b/0001-cpu-arm-Fix-incorrect-free.patch new file mode 100644 index 0000000..df5e02d --- /dev/null +++ b/0001-cpu-arm-Fix-incorrect-free.patch @@ -0,0 +1,70 @@ +From 65f3a9c481214ce015d20cee813dd9dac2de8dab Mon Sep 17 00:00:00 2001 +From: Sanchayan Maity +Date: Sat, 14 Jan 2023 15:14:29 +0530 +Subject: [PATCH] cpu-arm: Fix incorrect free + +A bug was introduced with the refactoring in da26563. In arm_init, +the buffer passed to spa_cpu_read_file is allocated and it is just +going to return that. So cpuinfo will actually point to buffer on +the stack, which need not be freed with a call to free. + +The crash resulting with the incorrect free. + +root@dragonboard-845c:~# pipewire --version +munmap_chunk(): invalid pointer +[ 185.037284] audit: type=1701 audit(1659949975.843:14): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2243 comm="pipewire" exe="/usr/bin/pipewire" sig=6 res=1 +Aborted +root@dragonboard-845c:~# wireplumber --version +munmap_chunk(): invalid pointer +[ 193.453693] audit: type=1701 audit(1659949984.255:15): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2244 comm="wireplumber" exe="/usr/bin/wireplumber" sig=6 res=1 +Aborted + +Backtrace from the crash + +(gdb) bt +!0 __pthread_kill_implementation (threadid=, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 +!1 0x0000fffff7d8edd8 in __pthread_kill_internal (signo=6, threadid=) at pthread_kill.c:78 +!2 0x0000fffff7d4a390 in __GI_raise (sig=sig@entry=6) at /usr/src/debug/glibc/2.36-r0/sysdeps/posix/raise.c:26 +!3 0x0000fffff7d37498 in __GI_abort () at abort.c:79 +!4 0x0000fffff7d83374 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0xfffff7e5fc20 "%s\n") at /usr/src/debug/glibc/2.36-r0/sysdeps/posix/libc_fatal.c:155 +!5 0x0000fffff7d988c0 in malloc_printerr (str=str@entry=0xfffff7e5a7f0 "munmap_chunk(): invalid pointer") at malloc.c:5660 +!6 0x0000fffff7d98aac in munmap_chunk (p=p@entry=0xffffffffd258) at malloc.c:3054 +!7 0x0000fffff7d9d068 in __GI___libc_free (mem=mem@entry=0xffffffffd268) at malloc.c:3375 +!8 0x0000fffff7cd36cc in arm_init (impl=impl@entry=0xaaaaaaac8c48) at /usr/src/debug/pipewire/1.0-r0/spa/plugins/support/cpu-arm.c:97 +!9 0x0000fffff7cd391c in impl_init (factory=, handle=0xaaaaaaac8c48, info=0xffffffffe548, support=, n_support=) at /usr/src/debug/pipewire/1.0-r0/spa/plugins/support/cpu.c:264 +!10 0x0000fffff7f3a234 in load_spa_handle (lib=, factory_name=factory_name@entry=0xfffff7f6d768 "support.cpu", info=info@entry=0xffffffffe548, n_support=1, + support=support@entry=0xfffff7fb0488 ) at /usr/src/debug/pipewire/1.0-r0/src/pipewire/pipewire.c:280 +!11 0x0000fffff7f3a5b0 in add_interface (factory_name=factory_name@entry=0xfffff7f6d768 "support.cpu", type=type@entry=0xfffff7f62310 "Spa:Pointer:Interface:CPU", info=info@entry=0xffffffffe548, + support=0xfffff7fb0430 ) at /usr/src/debug/pipewire/1.0-r0/src/pipewire/pipewire.c:358 +!12 0x0000fffff7f3b3f8 in pw_init (argc=argc@entry=0xffffffffea5c, argv=argv@entry=0xffffffffea50) at /usr/src/debug/pipewire/1.0-r0/src/pipewire/pipewire.c:661 +!13 0x0000aaaaaaaa1104 in main (argc=, argv=) at /usr/src/debug/pipewire/1.0-r0/src/daemon/pipewire.c:79 +(gdb) f 8 +!8 0x0000fffff7cd36cc in arm_init (impl=impl@entry=0xaaaaaaac8c48) at /usr/src/debug/pipewire/1.0-r0/spa/plugins/support/cpu-arm.c:97 +97 /usr/src/debug/pipewire/1.0-r0/spa/plugins/support/cpu-arm.c: No such file or directory. +(gdb) info locals +flags = 122 +cpuinfo = 0xffffffffd268 "processor\t: 0\nBogoMIPS\t: 38.40\nFeatures\t: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop\nCPU implementer\t: 0x51\nCPU architecture: 8\nCPU variant\t. +line = 0xaaaaaaac8ce0 "\310\252\252\252\n" +buffer = "processor\t: 0\nBogoMIPS\t: 38.40\nFeatures\t: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop\nCPU implementer\t: 0x51\nCPU architecture: 8\nCPU variant\t: 0x7\nCPU pa"... +arch = +__func__ = "arm_init" +--- + spa/plugins/support/cpu-arm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/spa/plugins/support/cpu-arm.c b/spa/plugins/support/cpu-arm.c +index cfc54272c..6cd68d813 100644 +--- a/spa/plugins/support/cpu-arm.c ++++ b/spa/plugins/support/cpu-arm.c +@@ -94,8 +94,6 @@ arm_init(struct impl *impl) + free(line); + } + +- free(cpuinfo); +- + impl->flags = flags; + + return 0; +-- +GitLab + diff --git a/0001-spa-Fix-audioconvert-overflow-when-scaling.patch b/0001-spa-Fix-audioconvert-overflow-when-scaling.patch new file mode 100644 index 0000000..3fe01a2 --- /dev/null +++ b/0001-spa-Fix-audioconvert-overflow-when-scaling.patch @@ -0,0 +1,75 @@ +From 1d9640af5a7906620f214aa0a39c63128c8506a6 Mon Sep 17 00:00:00 2001 +From: Wim Taymans +Date: Mon, 16 Jan 2023 18:28:31 +0100 +Subject: [PATCH] spa: Fix audioconvert overflow when scaling + +Add SPA_SCALE32_UP that scales a uint32 without overflow. +Use this for scaling the threshold in ALSA. +Fix the scaling in audioconvert of the buffer size, the scaling was +wrong and it was also causing an overflow resulting in choppy sound in +some cases. + +See #2680 +--- + spa/include/spa/utils/defs.h | 8 ++++++++ + spa/plugins/alsa/alsa-pcm.c | 4 ++-- + spa/plugins/audioconvert/audioconvert.c | 2 +- + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/spa/include/spa/utils/defs.h b/spa/include/spa/utils/defs.h +index c602c9348..3b4862663 100644 +--- a/spa/include/spa/utils/defs.h ++++ b/spa/include/spa/utils/defs.h +@@ -274,6 +274,14 @@ struct spa_fraction { + #define SPA_ROUND_DOWN_N(num,align) ((num) & ~SPA_ROUND_MASK(num, align)) + #define SPA_ROUND_UP_N(num,align) ((((num)-1) | SPA_ROUND_MASK(num, align))+1) + ++#define SPA_SCALE32_UP(val,num,denom) \ ++({ \ ++ uint64_t _val = (val); \ ++ uint64_t _denom = (denom); \ ++ (uint32_t)(((_val) * (num) + (_denom)-1) / (_denom)); \ ++}) ++ ++ + #define SPA_PTR_ALIGNMENT(p,align) ((intptr_t)(p) & ((align)-1)) + #define SPA_IS_ALIGNED(p,align) (SPA_PTR_ALIGNMENT(p,align) == 0) + #define SPA_PTR_ALIGN(p,align,type) ((type*)SPA_ROUND_UP_N((intptr_t)(p), (intptr_t)(align))) +diff --git a/spa/plugins/alsa/alsa-pcm.c b/spa/plugins/alsa/alsa-pcm.c +index 08b9ceddd..012b46031 100644 +--- a/spa/plugins/alsa/alsa-pcm.c ++++ b/spa/plugins/alsa/alsa-pcm.c +@@ -1999,7 +1999,7 @@ static inline void check_position_config(struct state *state) + (state->rate_denom != state->position->clock.rate.denom))) { + state->duration = state->position->clock.duration; + state->rate_denom = state->position->clock.rate.denom; +- state->threshold = (state->duration * state->rate + state->rate_denom-1) / state->rate_denom; ++ state->threshold = SPA_SCALE32_UP(state->duration, state->rate, state->rate_denom); + state->max_error = SPA_MAX(256.0f, state->threshold / 2.0f); + state->resample = ((uint32_t)state->rate != state->rate_denom) || state->matching; + state->alsa_sync = true; +@@ -2569,7 +2569,7 @@ int spa_alsa_start(struct state *state) + setup_matching(state); + + spa_dll_init(&state->dll); +- state->threshold = (state->duration * state->rate + state->rate_denom-1) / state->rate_denom; ++ state->threshold = SPA_SCALE32_UP(state->duration, state->rate, state->rate_denom); + state->last_threshold = state->threshold; + state->max_error = SPA_MAX(256.0f, state->threshold / 2.0f); + +diff --git a/spa/plugins/audioconvert/audioconvert.c b/spa/plugins/audioconvert/audioconvert.c +index 578f70ff9..783ab8174 100644 +--- a/spa/plugins/audioconvert/audioconvert.c ++++ b/spa/plugins/audioconvert/audioconvert.c +@@ -1755,7 +1755,7 @@ impl_node_port_enum_params(void *object, int seq, + size = this->quantum_limit * 2; + /* scale the buffer size when we can. */ + if (irate != 0 && orate != 0) +- size = size * (irate + orate - 1) / orate; ++ size = SPA_SCALE32_UP(size, irate, orate); + } + + param = spa_pod_builder_add_object(&b, +-- +GitLab + diff --git a/pipewire.changes b/pipewire.changes index e4cd57a..5a4046a 100644 --- a/pipewire.changes +++ b/pipewire.changes @@ -1,3 +1,19 @@ +------------------------------------------------------------------- +Tue Jan 17 08:28:49 UTC 2023 - Antonio Larrosa + +- Add patch from upstream to avoid division by 0 and other issues + with invalid values (glfo#pipewire/pipewire#2953): + * 0001-alsa-guard-against-some-invalid-values.patch +- Add patch from upstream to fix causing an overflow resulting in + choppy sound in some cases (glfo#pipewire/pipewire#2680): + * 0001-spa-Fix-audioconvert-overflow-when-scaling.patch + +------------------------------------------------------------------- +Mon Jan 16 08:21:05 UTC 2023 - Antonio Larrosa + +- Add patch from upstream to fix a crash on arm: + * 0001-cpu-arm-Fix-incorrect-free.patch + ------------------------------------------------------------------- Fri Jan 13 07:46:11 UTC 2023 - Antonio Larrosa @@ -21,12 +37,13 @@ Fri Jan 13 07:46:11 UTC 2023 - Antonio Larrosa * PipeWire - Clear all peer input port buffers when suspending. This fixes some SIGBUS errors when some plugins were using old memory. - (#2914) + (glfo#pipewire/pipewire#2914) - Fix a case where nodes that were not supposed to be - suspended, were kept suspended on a rate change. (#2929) + suspended, were kept suspended on a rate change. + (glfo#pipewire/pipewire#2929) - Fix an error in the quantum and rate calculations that could cause nodes to run with wrong quantum and rates when multiple - rates were allowed. (#2925) + rates were allowed. (glfo#pipewire/pipewire#2925) * Tools - pw-dump will now sort dictionaries to make it easier to compare different outputs. @@ -41,16 +58,16 @@ Fri Jan 13 07:46:11 UTC 2023 - Antonio Larrosa - ROC 0.2.X is now required. - The pulse tunnel and RTP source were not updating the rate field correctly which could cause synchronization problems. - (#2891) + (glfo#pipewire/pipewire#2891) - The filter-chain now supports an arbitrary number of control - properties. (#2933) + properties. (glfo#pipewire/pipewire#2933) - It is now possible to assign custom port names to the ports from an adapter with the PW_KEY_NODE_CHANNELNAMES. - Support was added for capture and playback props in - echo-cancel. (#2939) + echo-cancel. (glfo#pipewire/pipewire#2939) * SPA - The ACP code now has an option to set the probe samplerate. - (#1599) + (glfo#pipewire/pipewire#1599) - UCM devices now also have a Pro Audio profile. - Filtering of Step ranges is now implemented. * Pulse-Server @@ -59,13 +76,14 @@ Fri Jan 13 07:46:11 UTC 2023 - Antonio Larrosa - source_master and sink_master are now correctly handled in module echo-cancel. - Fix a regression in DRAIN where resuming after a DRAIN would - fail. This caused problems for espeak. (#2928) + fail. This caused problems for espeak. + (glfo#pipewire/pipewire#2928) - TARGET_OBJECT is now used to make it possible to use the indexes as a target. - ladspa-source and remap-source can now also link to monitors. * ALSA - The ALSA plugin now handles the target.object correctly when - set to -1. (#2893) + set to -1. (glfo#pipewire/pipewire#2893) * V4L2 - The v4l2 replacement library now also follows symlinks. - Support for getting and setting controls was added. diff --git a/pipewire.spec b/pipewire.spec index b31b02c..2b0df62 100644 --- a/pipewire.spec +++ b/pipewire.spec @@ -64,6 +64,12 @@ Source0: %{name}-%{version}.tar.xz Source99: baselibs.conf # PATCH-FIX-OPENSUSE reduce-meson-dependency.patch Patch0: reduce-meson-dependency.patch +# PATCH-FIX-UPSTREAM 0001-cpu-arm-Fix-incorrect-free.patch +Patch1: 0001-cpu-arm-Fix-incorrect-free.patch +# PATCH-FIX-UPSTREAM 0001-alsa-guard-against-some-invalid-values.patch +Patch2: 0001-alsa-guard-against-some-invalid-values.patch +# PATCH-FIX-UPSTREAM 0001-spa-Fix-audioconvert-overflow-when-scaling.patch +Patch3: 0001-spa-Fix-audioconvert-overflow-when-scaling.patch BuildRequires: docutils BuildRequires: doxygen @@ -356,6 +362,9 @@ This package provides a PulseAudio implementation based on PipeWire %if 0%{?suse_version} <= 1500 && 0%{?sle_version} <= 150300 %patch0 -p1 %endif +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 %build %if %{pkg_vcmp gcc < 8}