diff options
| author | Cássio Gabriel <cassiogabrielcontato@gmail.com> | 2026-05-25 11:16:09 -0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-05-26 07:54:36 +0200 |
| commit | 3fcc84f1f8d28cc1966b859cef33c858ff531766 (patch) | |
| tree | 4b90808165dd7c889a9f554d4f1f2641700bc3b8 | |
| parent | 5d1d092b8df9aa3c45a58a22e13b92afa850146f (diff) | |
| download | linux-next-history-3fcc84f1f8d28cc1966b859cef33c858ff531766.tar.gz | |
ALSA: seq: Remove arbitrary prioq insertion limit
The sequencer priority queue insertion path uses a hardcoded traversal
limit of 10000 entries. The value is intended to catch a corrupted list,
but it also becomes a real limit for valid queues.
The event pool limit is per client, while a sequencer queue can be shared
by multiple clients. A queue can therefore legitimately contain more than
10000 events. In that case, inserting an event that has to be placed past
the arbitrary limit fails with -EINVAL.
Use the queue's own cell count as the traversal bound instead. This keeps
the protection against inconsistent list accounting or cyclic lists without
rejecting valid large queues.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260525-alsa-seq-prioq-limit-v1-1-16c348df5ff7@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/core/seq/seq_prioq.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c index 25c0ed8f9f0f8..d5bad1c585f64 100644 --- a/sound/core/seq/seq_prioq.c +++ b/sound/core/seq/seq_prioq.c @@ -132,7 +132,7 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, struct snd_seq_event_cell * cell) { struct snd_seq_event_cell *cur, *prev; - int count; + int remaining; int prior; if (snd_BUG_ON(!f || !cell)) @@ -162,10 +162,16 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, prev = NULL; /* previous cell */ cur = f->head; /* cursor */ - count = 10000; /* FIXME: enough big, isn't it? */ + remaining = f->cells; while (cur != NULL) { /* compare timestamps */ int rel = compare_timestamp_rel(&cell->event, &cur->event); + + if (remaining-- <= 0) { + pr_err("ALSA: seq: inconsistent prioq cell count\n"); + return -EINVAL; + } + if (rel < 0) /* new cell has earlier schedule time, */ break; @@ -176,10 +182,6 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, /* move cursor to next cell */ prev = cur; cur = cur->next; - if (! --count) { - pr_err("ALSA: seq: cannot find a pointer.. infinite loop?\n"); - return -EINVAL; - } } /* insert it before cursor */ |