From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38668C4321E for ; Mon, 17 Jan 2022 17:11:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241199AbiAQRLR (ORCPT ); Mon, 17 Jan 2022 12:11:17 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:57200 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242127AbiAQRHI (ORCPT ); Mon, 17 Jan 2022 12:07:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AFDFA6126B; Mon, 17 Jan 2022 17:07:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28297C36AE7; Mon, 17 Jan 2022 17:07:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1642439224; bh=1j7mayRmOuGQ+nRLdXsL59wVA+c5vHDalgnqM39ocY4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OTAl/Lrwu4lOzIwND36pXNZhSQAgFhaKFtlOXboCmL7WxFf9bqg39o6Lyt1hT9g6U 5QU5Esv8x65hvM5RWUFIobeUviIhJjMg+JiOcXKW1DznU8YR5CBUrvhbWdwHv1UsZQ W0djNk6dgs0UPM9TpovYTKWXTMiaie72ont7cSGi6Vz48n8ODd6qDYx82+nE9ucu5y 3ls6cB1yIRuGaYOKvPpzDqCoWsNkjLsqY2cmWwmAK5Q1TpsSXK4pmzLkAEACsWwjd6 R0yIk+pIQTZP/i8zMLreB8+/OsyiCFG6n78ByrSchTCUCT7LwAIbmtp5SVvXIeXugR 3fp56DoUwoQ9Q== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Takashi Iwai , Zqiang , syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com, Sasha Levin , perex@perex.cz, tiwai@suse.com, alsa-devel@alsa-project.org Subject: [PATCH AUTOSEL 4.14 11/16] ALSA: seq: Set upper limit of processed events Date: Mon, 17 Jan 2022 12:06:33 -0500 Message-Id: <20220117170638.1472900-11-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220117170638.1472900-1-sashal@kernel.org> References: <20220117170638.1472900-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Takashi Iwai [ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] Currently ALSA sequencer core tries to process the queued events as much as possible when they become dispatchable. If applications try to queue too massive events to be processed at the very same timing, the sequencer core would still try to process such all events, either in the interrupt context or via some notifier; in either away, it might be a cause of RCU stall or such problems. As a potential workaround for those problems, this patch adds the upper limit of the amount of events to be processed. The remaining events are processed in the next batch, so they won't be lost. For the time being, it's limited up to 1000 events per queue, which should be high enough for any normal usages. Reported-by: Zqiang Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail.com Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/core/seq/seq_queue.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c index ea1aa07962761..b923059a22276 100644 --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -257,12 +257,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *name) /* -------------------------------------------------------- */ +#define MAX_CELL_PROCESSES_IN_QUEUE 1000 + void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) { unsigned long flags; struct snd_seq_event_cell *cell; snd_seq_tick_time_t cur_tick; snd_seq_real_time_t cur_time; + int processed = 0; if (q == NULL) return; @@ -285,6 +288,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } /* Process time queue... */ @@ -294,14 +299,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } + out: /* free lock */ spin_lock_irqsave(&q->check_lock, flags); if (q->check_again) { q->check_again = 0; - spin_unlock_irqrestore(&q->check_lock, flags); - goto __again; + if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { + spin_unlock_irqrestore(&q->check_lock, flags); + goto __again; + } } q->check_blocked = 0; spin_unlock_irqrestore(&q->check_lock, flags); -- 2.34.1