From nobody Mon May 25 04:34:31 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6C5238F947 for ; Mon, 18 May 2026 19:40:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133232; cv=none; b=d486ODYfpoaS3soAc+qZrUL5qLspbqBZkmNkiczue3R4movTMloP73q4x55CTajN93Hy9SZB0+rcPFJE87tpDJy3No6ugARv7gwPiH/+1735qf80lB0S+fUyuuhQpwkt0/WsdOpWn7GDBsw6yY6HL+K/varkzu2Xs0zotBvea/o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133232; c=relaxed/simple; bh=wKXl8y8wUe+rJNJmHqOBxEz0hRo+ZGkdSMCkKFWiIbE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Wq9kZqGQ1lepqVoo5S2GIkzkbx5NaEDV7yM+4QH5E5ciXr/D0bbJCfxjt17g524XVpZPAh/YEXwr5G3wglFmap54sX48vpkQ2R8ezI0fWwGlCiDWmg529XPwkPrwXyww6+lGDWrpNTC5w0Ud+UAvBHYEhoccY2PT3yollcYmrr0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iov1aCj1; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iov1aCj1" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-837dfccd950so1221415b3a.0 for ; Mon, 18 May 2026 12:40:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779133230; x=1779738030; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JwhsmHK7kOuOjmpUhw7nH/iDxBwlkv7cOTMO53PauZM=; b=iov1aCj1B5kLO/CyqR41fCrLiXy/x4ERvlbv7EIJNLRkYN3MaG66fcMV43zPJhDSUd iyqZA3gMNcReelt+zhTwHwXY7xPnfG1rIEraltoUzzDrwXuupnYjo+Ri4DGgCJ8BEHsW gOU5CpCTKF+xc3bVix5X7tAF8DcHwegE8TGOAH4ynn893m5SPJPtD9RJjL9D/4Bk36bX zXkhvKlby+DoquapRurYImVZmmF2s4++Thrfz3KA/8i7WVvMAjDXO563xdUUDtXWEHTX dYt06aeGd+TJHZoo3/OHYUSe+t2zWhTCWKKr9j9UPqNJbgdaPl+fLYXg4eLEZRA6A0bs HGYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779133230; x=1779738030; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=JwhsmHK7kOuOjmpUhw7nH/iDxBwlkv7cOTMO53PauZM=; b=ZH4FvdBQSMZ+f4v+hdf6boqrEa8uVWfyXcrReJNTOV+Uu4YE+Mgmt9/f2WJHP83fDH i42mIk6F6JJ/u6pStxvdThE7/IufHg01zNjQ702WiHhQa6nerJYFBotB8k1yt32Kda6e k6fRI1a1vd809kevwWPoSgIsr9QqdgZPOdISK0wk4kMF/clHG0Nc4LEKMH0BwvnMRqvr u9kkqCUV3GKHAYeIlLZGZpWGeKZJZddiWL2UpzStSteUA2e9EDCEw29titjopU6vcPo7 gZEpGPuuBP0xB+QmW6UjTS24gf+s2ayI12UqJ2VeFfHuDkstD2nBAyjSNrup4aFS5zmX D3RQ== X-Forwarded-Encrypted: i=1; AFNElJ+kn3SX/R7hMLonUJ6PVTFA2Cq4gMu0xXXX12MjdlYC2H8nFNwSlBaS/PtI2GJMSaQVFt+J/Mxr9S6D5iQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwSPUGpbTRQ+C/UcN13dkS8n40jdDLX4RZRTkov1TPmb+//S0NX MsKw2McbPc5/fZYlMLC/Osvp7nNz94EsAAXrbKyL7Zfr6IdoV9QHPCm5 X-Gm-Gg: Acq92OF2PWrNB1RyybGtx7265iDMtkiM1dmmVa+vyqy3ceU2libBzYGoQM/lb0XFbve MHK/F5u3V9U4z1tWhDJBwnZ2uARSTSMKSy4tzTjXiGIF7Q+q2qLhyG7PESHPkHcLHtmpRT0GmfD Q/FSk2fVF8CPr81Rctw+TCCAOWJreMZtw0XDj2E5YevBbwBmMv135IEBiaS10793pMvzm1quixQ 1OU7qVknN0jX3LdhT568Zs18D7Y/cFp8RJpMgn7ABKywNt2CleBWQsHOgVwGkjTknXxtUY0WZmA 5qjWaT/r0F0TNqkNwqdxKmzhQWVSrB2apzozFC9sqKdP4aCWpqPwytFhjHZqZRV+x+A7Z2eqwF0 DkQwBaJNgLYthBqxJSR3qBbvWXxnFApmqoeMb35yn3dg4hy6t+7qbkqpG7WMqavAhp0CwbpWmQu zyKLH3fqg4xLtDOsMakMP/AwfNUgW0iXAiV85DEBkgb6gOG9/7DLFYDET3DCk= X-Received: by 2002:a05:6a20:7f93:b0:3aa:60e0:b2ed with SMTP id adf61e73a8af0-3b22ebc68ddmr18073852637.27.1779133230087; Mon, 18 May 2026 12:40:30 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c82bb07d2fesm14237808a12.9.2026.05.18.12.40.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 12:40:29 -0700 (PDT) From: Maoyi Xie To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() Date: Tue, 19 May 2026 03:40:22 +0800 Message-Id: <20260518194023.1667857-2-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260518194023.1667857-1-maoyixie.tju@gmail.com> References: <87o6ic4izy.wl-tiwai@suse.de> <20260518194023.1667857-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snd_timer_dev_register() walks snd_timer_list looking for the ordered insertion point and on loop fall-through passes &timer1->device_list to list_add_tail(): list_for_each_entry(timer1, &snd_timer_list, device_list) { ... break; /* on found-position */ ... } list_add_tail(&timer->device_list, &timer1->device_list); When the loop walks all entries without break, timer1 is past-the-end. &timer1->device_list aliases &snd_timer_list (the list head) via container_of offset cancellation, so the insert lands at the list tail. That is the intended behaviour, but the access is undefined per C11 even though it works in practice. Track an explicit insert_before pointer initialised to the list head and overwritten to &timer1->device_list only when the loop breaks early. The observable behaviour is unchanged. Fixes: 9244b2c3079f ("[ALSA] alsa core: convert to list_for_each_entry*") Signed-off-by: Maoyi Xie --- sound/core/timer.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) --- a/sound/core/timer.c 2026-05-18 19:17:08.274971549 +0800 +++ b/sound/core/timer.c 2026-05-18 19:17:46.598676455 +0800 @@ -1007,6 +1007,7 @@ { struct snd_timer *timer =3D dev->device_data; struct snd_timer *timer1; + struct list_head *insert_before =3D &snd_timer_list; =20 if (snd_BUG_ON(!timer || !timer->hw.start || !timer->hw.stop)) return -ENXIO; @@ -1016,28 +1017,36 @@ =20 guard(mutex)(®ister_mutex); list_for_each_entry(timer1, &snd_timer_list, device_list) { - if (timer1->tmr_class > timer->tmr_class) + if (timer1->tmr_class > timer->tmr_class) { + insert_before =3D &timer1->device_list; break; + } if (timer1->tmr_class < timer->tmr_class) continue; if (timer1->card && timer->card) { - if (timer1->card->number > timer->card->number) + if (timer1->card->number > timer->card->number) { + insert_before =3D &timer1->device_list; break; + } if (timer1->card->number < timer->card->number) continue; } - if (timer1->tmr_device > timer->tmr_device) + if (timer1->tmr_device > timer->tmr_device) { + insert_before =3D &timer1->device_list; break; + } if (timer1->tmr_device < timer->tmr_device) continue; - if (timer1->tmr_subdevice > timer->tmr_subdevice) + if (timer1->tmr_subdevice > timer->tmr_subdevice) { + insert_before =3D &timer1->device_list; break; + } if (timer1->tmr_subdevice < timer->tmr_subdevice) continue; /* conflicts.. */ return -EBUSY; } - list_add_tail(&timer->device_list, &timer1->device_list); + list_add_tail(&timer->device_list, insert_before); return 0; } =20 --=20 2.34.1 From nobody Mon May 25 04:34:31 2026 Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A181A3909A9 for ; Mon, 18 May 2026 19:40:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133237; cv=none; b=WUGAGpqsKUeWc5WnDKXNTqnJn/LiPrqbJpodAu8PNV8aYVpJWQJtV7UsrS48FDNl3dqG6SSGG/yaJroCjh3ux6VepY2DNAq7DhVR/ft4Iwppw/jdOPiEJRF4SKLf14siEkmrksWdPVEqWo7pHfi42/6m09izkgJWAljk/wzf64A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779133237; c=relaxed/simple; bh=OvkOHU1s6rxi6bmBlqrdaePC7iDQtRImHoWamAQ2Fk8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IgqRRL2q6qzdb8mfRjoFiMRXmnaATbeNrYuuQBYNNMQkARj7ePCj+/IeyoF7uGc0W0LEAXtCbsdiATMY+0UKSyBqGedx8/GYBKzd9ofCt6J/YRjHwIHVoZ1g/tQfHNcJmOUo3kYqrnawYkfSELH6aZ273zIF81T28HeC486KEwg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HPRMotCv; arc=none smtp.client-ip=209.85.215.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HPRMotCv" Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-c736261ee8dso1200043a12.1 for ; Mon, 18 May 2026 12:40:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779133232; x=1779738032; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=rNNDtnW3u1lf/429513OlTaYgvxVqJNtfeBcvswLKUo=; b=HPRMotCvVLR9AtJwIClryfMpXb7o/bEOSgD75pGxdxeJNAJ8S4hqd84xVAl7vqUyCu Zl0mxcw7JB0oph0T289/d/DR1xIwE4Au2Rvoyt+AL7lDJauxhZ81SWJb6U94vy4uGlWo AFRu8Bbf5vMQJmVy5M3g8VctESqRnl+4rKzVX0s+5Gtb+LDYzj0bnvybZ6HPW821pkdU EZbaJ9G3IJQbe3okBOd+X0skDzk/WsG9uq66l7x5BySU7YcBbqlQE/rpOQIeQNYpTWSU DTudIpIIryQ0E2oL6rW9o+jkGqB9NhX1u2CpJLpl7oZNRfUle0kfvksziofWDSqZJMPN FgMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779133232; x=1779738032; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=rNNDtnW3u1lf/429513OlTaYgvxVqJNtfeBcvswLKUo=; b=TdvH6xbF0It2oIapsYTtEal4yLnEW2YmctWPyt1oSQG8ctyKknVVcLd/TBAmA2gVoo d38LBYLKOirNk/lbHLwnDvTxQjdMj6Fan8HsrL3Ja8RiH+90826gkNYAJ0W0QtfxNusX T1BktgHgYB/t1zYFOBP75d1NdW/EdFr8BYcE1z3M0Cojyye0Umj4RTVZ+2bGh1G+L83S BfpppeMTHPYW5Np/ZFstD7CnDDesqkcx1gCCv987KqL3cJwD9Cbleg0n7DmPfCRy17SP c3Y5rEhpWEmF67Qv2P8oDtnLGrMjQj17AEkEaMLFbFJKJrrGm+kzbzTPvAjc72yxVJxz 69tQ== X-Forwarded-Encrypted: i=1; AFNElJ+Lx4XdNQumfhPWbZVoDXvYg52aPxzcMNvP8mbyRMywHW9cdRBBh2vfy6FN7hMOAYDgmsy8nZsIR8l1Bn8=@vger.kernel.org X-Gm-Message-State: AOJu0Yyh3rh6JuoRqsqWuZ2R7Bryd/FhtWJM8fNsFQ74btXp6O8GQDv5 aiGo/U4bMJ/mf+/uoewzalR29+W0Se1qsRB7d0BHPokfUgSkUQmrKxpk X-Gm-Gg: Acq92OHVSR8OMcWRfaPLhQtrOWWLs8QnYJ1miFUbmbr/5kjzysWS+FzyhuHw57q4VCC W5p17B+FByPSfwjz41v7ZwechQx0C+g7rvCfBMlvknjmQoJMa3nZJGIaKm6qH/9UjUVcvIEDImb NRGa7aBFzll1TW9DWlLUPgLW0+u2p1/4mrk0erXykeIgi+iCUYstfb9pl4w4zJsmoRg4/Dvn8E8 j7DfSxh7IcFZrr+azY8IZBMtoDg7VUS5ov1+Cu3Z/Oe+IMelf88FWYWCvitqWyxwsZND8nwKAT0 /ePkHTXA9ndsLfxs99Eua3LBKHN9bsU+rURel2NarwiZ5svGG5IifY9Uj49GmxVJq7XfBiSjaM0 vop7lnOhD31Lsez6OS2Iz4ifWogU5EEBQAEiYnoKhJzmr75T+OaAT4Hn6AVGTt2cdpx61O39648 OLmLbvNdebP7DIIhol0nYTzt0gdAUKIPpQParwECUrcwprdxBE X-Received: by 2002:a05:6a20:244f:b0:3a3:1071:89f0 with SMTP id adf61e73a8af0-3b22e65c034mr19513563637.2.1779133231982; Mon, 18 May 2026 12:40:31 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c82bb07d2fesm14237808a12.9.2026.05.18.12.40.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 12:40:31 -0700 (PDT) From: Maoyi Xie To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() Date: Tue, 19 May 2026 03:40:23 +0800 Message-Id: <20260518194023.1667857-3-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260518194023.1667857-1-maoyixie.tju@gmail.com> References: <87o6ic4izy.wl-tiwai@suse.de> <20260518194023.1667857-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snd_seq_create_port() walks client->ports_list_head looking for the ordered insertion point and on loop fall-through passes &p->list to list_add_tail(): list_for_each_entry(p, &client->ports_list_head, list) { if (p->addr.port =3D=3D port) { kfree(new_port); return -EBUSY; } if (p->addr.port > num) break; ... } list_add_tail(&new_port->list, &p->list); When the loop walks all entries without break (e.g., the new port sorts last), p is past-the-end. &p->list aliases &client->ports_list_head (the list head) via container_of offset cancellation, so the insert lands at the list tail. That is the intended behaviour, but the access is undefined per C11 even though it works in practice. Track an explicit insert_before pointer initialised to the list head and overwritten to &p->list only when the loop breaks early. The observable behaviour is unchanged. Fixes: 9244b2c3079f ("[ALSA] alsa core: convert to list_for_each_entry*") Signed-off-by: Maoyi Xie --- sound/core/seq/seq_ports.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/sound/core/seq/seq_ports.c 2026-05-18 19:17:08.278971518 +0800 +++ b/sound/core/seq/seq_ports.c 2026-05-18 19:18:44.006234339 +0800 @@ -144,18 +144,21 @@ num =3D max(port, 0); guard(mutex)(&client->ports_mutex); guard(write_lock_irq)(&client->ports_lock); + struct list_head *insert_before =3D &client->ports_list_head; list_for_each_entry(p, &client->ports_list_head, list) { if (p->addr.port =3D=3D port) { kfree(new_port); return -EBUSY; } - if (p->addr.port > num) + if (p->addr.port > num) { + insert_before =3D &p->list; break; + } if (port < 0) /* auto-probe mode */ num =3D p->addr.port + 1; } /* insert the new port */ - list_add_tail(&new_port->list, &p->list); + list_add_tail(&new_port->list, insert_before); client->num_ports++; new_port->addr.port =3D num; /* store the port number in the port */ sprintf(new_port->name, "port-%d", num); --=20 2.34.1