Skip to content

Upstream - #136

Open
ffrancis123 wants to merge 5 commits into
AudioReach:masterfrom
ffrancis123:up
Open

ffrancis123 wants to merge 5 commits into
AudioReach:masterfrom
ffrancis123:up

Conversation

@ffrancis123

Copy link
Copy Markdown
Contributor

Commits Included:
agm: tinyalsa plugin skip close on borrowed fds
agm: fix duplicated record at non-48kHz ULL MMAP rates
agm: fix UAF in ClientInfo::onDeath death-recipient cookie
agm: service: fix param_list truncation in ACDB tunnel tag-data path
agm: improve configuration flexibility and usability

yidongh and others added 5 commits September 3, 2026 12:53
The tinyalsa AGM plugin closes data and position buffer fds during
pcm close handling. After the recent framework path updates, those
fds are managed by AGM service side ownership and can be reused or
released there.

Keeping local close() calls in the plugin can cause double close
issues once AGM cleanup runs. Remove explicit close() of data and
position buffer fds while retaining existing unmap and memory free
behavior.

Signed-off-by: ffrancis <ffrancis@qti.qualcomm.com>
Lower period_bytes.min from 96 to 16 bytes to support ULL
MMAP capture rates down to 8 kHz and avoid incorrectly
clamping sub-48 kHz streams.
The 96-byte floor forced a period mismatch between the DSP
producer and client consumer, causing previously delivered
PCM data to be re-presented and resulting in duplicated
capture audio.
The actual period size is still derived from the HAL buffer
configuration, so existing 48 kHz and other working use
cases remain unaffected.

Signed-off-by: ffrancis <ffrancis@qti.qualcomm.com>
registerCallback linked to death with the ClientInfo* itself as
cookie. Since one client can have multiple death links sharing
that cookie, a second/duplicate obituary could dereference the
cookie after the first one already freed the object via
removeClient, causing a use-after-free crash.

Encode the client's pid instead of the ClientInfo* as the death
recipient cookie. onDeath decodes the pid and calls the already
idempotent removeClient(pid), so it never touches memory that a
prior obituary may have freed.

Signed-off-by: ffrancis <ffrancis@qti.qualcomm.com>
graph_get_tckv_data_from_acdb() builds param_list as a list of 32-bit
words [module_instance_id, num_params, param_id] that is handed to
gsl_get/set_*_data_from_acdb(). The GCC 14.2 typecast cleanup
("agm: service:
fix typecasting issues for GCC 14.2") changed its declaration from
uint32_t* to uint8_t*, which truncates each 32-bit field to its low
byte. The ACDB query is then built with a corrupt module_instance_id
(e.g. 0x0026016e instead of 0x416e), ACDB reports "module instance not
found", and the call fails with -68.

This breaks GEF (Generic Effects Framework) effect reads over the ACDB
tunnel: the catf equalizer test aborts with an uncaught
HALTestSUTException (pal_gef_rw_param failed, returned -68).

Restore param_list to uint32_t* so the fields are written full-width.
The (uint8_t *)param_list casts already present at the gsl_*_from_acdb
call sites keep the GCC 14.2 typecast fix intact.

Tested on hamoa_la (COMPUTE.LA.1.0): the CATF QAL test
pcm_playback_pcm_offload_equalizer_acdb_on_2ch_16bit_48khz_on_spkr.xml
now returns Result=pass; previously it crashed with SIGABRT.

Compilation verified with GCC 14.2 via the upstream AudioReach PR for
the same change (GitHub CI build matrix green):
AudioReach#129

Signed-off-by: ffrancis <ffrancis@qti.qualcomm.com>
Update the build configuration, including the use
of USE_GLIB and USE_G_STR_FUNC to control glib
usage, USE_SYSLOG for syslog, and CUTILS_SUPPORTED
for cutils.

Add support for configuring period_size and n_periods
parameters in agmplay.

Signed-off-by: ffrancis <ffrancis@qti.qualcomm.com>
@ffrancis123
ffrancis123 requested review from a team September 3, 2026 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants