From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 779FF480DCB for ; Mon, 18 May 2026 16:00:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779120051; cv=none; b=DT7zIYS/eaUl2XLV/JotplODLzCDppXxT3hkr/aRO9pZUeObdTb6euxaNV8x/qOnUVGf1TR/tw8aWcyETQCDypOVxRcUWYstfXZFuCnKlNr+ya7ye0PsbJK7rkfTGj6E9ujIKsR7gv/YtFo4+U/sa4E85tGBDLM4KIH7WO4D59Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779120051; c=relaxed/simple; bh=ieOV+o8gPZkNv6bcagFTRTdIXtS08vega1cz4HTnRyg=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=E0nFXzsLNl3YIlB/VSEtpOq92ffUIbmTVbAGsmQJHMR5tCnTwtvtWZYNORzBF7vtXRBn/JkLiKadEPwlIn52gSc7DkyKfKyWXA3vSAVCOiSq0dV05uWQuGv7NP/gt9cPDhYvxGRDbESZTf/GVdXr/yLliUdjURUDrufx/tCfnG4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e5BpZ1PQ; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e5BpZ1PQ" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-368f25ff4c4so1180281a91.2 for ; Mon, 18 May 2026 09:00:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779120036; x=1779724836; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=1P9Pumhzo4xFId6dhvQoSs/K6cq6qzesEQoaX9OecWM=; b=e5BpZ1PQOf1Ye9+Ml7Xlr1LlhZkZq3/cEi7gx5sxHhVs3Lrn5GT1cZ/l5t31YSFFgb DicfjqCu3aR/W+LQ7+WGNQEwjc98M/a7ccY8eTjeU1cFolcDS6FFpMIi5bs7wI4USWbG tg0Bxvw7fl5CnOcLAES1lC89eimLwiw88YLyk9/H/pEkrVca5jGpd9bzatOmDu5aZ7sk ugCHDD3qDuTe8VGLfcChsnXOVokI9zbxMV/98oAzRL7JCLPYurIa3zuK2C3c0chCR2FA MseLwMh6nadLUm89//LtUpbkWUFmpzB6aq9X/P16CmjQ80m7j3E/kZTzps77vJ5khj06 16Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779120036; x=1779724836; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=1P9Pumhzo4xFId6dhvQoSs/K6cq6qzesEQoaX9OecWM=; b=pVGhZZ19x18DWoIwGeeMrqI/uykRi/82YRxkM7O7/HTKDfJ6praVa7NxrR2Ums7FIG bo2cx5yIyXkyFUokt0/I8FOaXWfoNjzH7I/ht3rSlQv/vlkvSXCaCa/TeXmM2ehTKbxt af5EK3FdRYLJOHG4HErjlr21miFYIJfX0GMgAFXnd24ezk65loqXj3dBl3odxKyJG1Uw RJ4jbYrzB2X8VBdToVM8B2wxZhRDqVb0HwsMqaK6z83KrDKPxt98gu63kiWRFzn+CRRb GsswrqDGCYbX8LjxCbHheezG4baA94Hr1h0/kaQiHRCWZBgixEE/6QUHMcVfSB6HNphg m3Ww== X-Forwarded-Encrypted: i=1; AFNElJ/yfsjkopCzKn7NTy9md1tyozb5VVUBVacsvUtXUPy8tuP2Vc8HleRQ87E9Q3NvwACFUn83s9Qv3rWnxOA=@vger.kernel.org X-Gm-Message-State: AOJu0YzEz5Am/BNj+m8JGjA0GQR0mcEwjRktScAaPwgAy+dNYd5BdbOc W4Foo/RoiLRhLy8Pnd85wVGsa+uU/BjVlCaxQZ4cZYYbq1UhF8BKR+2R X-Gm-Gg: Acq92OEHg3+A76E/FYCHxaGhcFFm4nlQ+QokJtNkcLzCa46gj02Y5NbY2Ck99zvgimH U7Dii+FmsswPQ15l4C9pXci4KshFVqeYdNxnRQjTSEUiZb92IyKnAKtNeosxnW+VEOE/1wsli01 ZShtkhC/uQQn29pF95GanG0dRAx1p3b4YiHQkpOw/lRCp75zBpkJh8ergzzKRxSavD0lTes3sQ6 kWyOLGLvQWHcR8cwrGnbTbiLgSX1KWAGTgFY4A5uHLC3rFjbug1VzfYv4xnAyaatj4Ke1r+76Qu KbDK+T82TaLXbPdj5jZKVlMwLrvmlBN4GsE4RA4L2h2Sx1mnEO9Kg27+sL84PAV2BMbB+NlL7HE X6akRGx/l2hpRyEij37uvDJH+1cwy3sdeHDJo5XZqZUAGkK8xdVOXMHFQ2wF0LIyRFJ+3VXeSOF 0vuDN5kKPMF2HVWlnLJUX3v0DbUxas0CdfzToX5FoqDGzRDY5t X-Received: by 2002:a17:90b:270d:b0:368:1064:62f2 with SMTP id 98e67ed59e1d1-369518b205fmr15020093a91.3.1779120034444; Mon, 18 May 2026 09:00:34 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bd5cfe64a9sm155831905ad.53.2026.05.18.09.00.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 09:00:33 -0700 (PDT) From: Maoyi Xie To: Jaroslav Kysela , Takashi Iwai Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org Subject: ALSA: iterator used after loop end in timer/seq port registration? Date: Tue, 19 May 2026 00:00:29 +0800 Message-Id: <20260518160029.1529836-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi all, While reading sound/core/ I noticed two places where the list iterator is used after the loop has walked past the end of the list. I would appreciate it if you could take a look and let me know whether these are real issues, and whether they are worth fixing. The first is snd_timer_dev_register() in sound/core/timer.c (linux-7.1-rc1, around line 1018): list_for_each_entry(timer1, &snd_timer_list, device_list) { if (timer1->tmr_class > timer->tmr_class) break; ... return -EBUSY; } list_add_tail(&timer->device_list, &timer1->device_list); The second is snd_seq_create_port() in sound/core/seq/seq_ports.c (linux-7.1-rc1, around line 147): list_for_each_entry(p, &client->ports_list_head, list) { ... if (p->addr.port > num) break; ... } list_add_tail(&new_port->list, &p->list); In both cases, when the loop walks all entries without break, the iterator has gone one step past the last entry. &iter->member then aliases the list head via container_of offset cancellation, so the insert lands at the list tail. That is the intended behaviour, but the access is undefined per C11. Jakob Koschel cleaned up many such sites in 2022, for example commits 99d8ae4ec8a (tracing: Remove usage of list iterator variable after the loop), 2966a9918df (clockevents: Use dedicated list iterator variable) and dc1acd5c946 (dlm: replace usage of found with dedicated list iterator variable). The two sites in sound/core/ were not covered. A candidate fix would track an explicit insert_before pointer initialised to the list head and overwritten to &iter->member only when the loop breaks early. The observable behaviour is unchanged. If this is intentional or already known, please disregard. Otherwise, I am happy to send a [PATCH] or to leave the fix to you. Thank you for your time, and sorry for the noise if this is not actually worth fixing or has already been spotted. Thanks, Maoyi Xie https://maoyixie.com/