Patch "ALSA: seq: Set upper limit of processed events" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ALSA: seq: Set upper limit of processed events

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-seq-set-upper-limit-of-processed-events.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 08a024018e5190c7de4b9f553fd985769a397022
Author: Takashi Iwai <tiwai@xxxxxxx>
Date:   Tue Dec 7 17:51:46 2021 +0100

    ALSA: seq: Set upper limit of processed events
    
    [ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ]
    
    Currently ALSA sequencer core tries to process the queued events as
    much as possible when they become dispatchable.  If applications try
    to queue too massive events to be processed at the very same timing,
    the sequencer core would still try to process such all events, either
    in the interrupt context or via some notifier; in either away, it
    might be a cause of RCU stall or such problems.
    
    As a potential workaround for those problems, this patch adds the
    upper limit of the amount of events to be processed.  The remaining
    events are processed in the next batch, so they won't be lost.
    
    For the time being, it's limited up to 1000 events per queue, which
    should be high enough for any normal usages.
    
    Reported-by: Zqiang <qiang.zhang1211@xxxxxxxxx>
    Reported-by: syzbot+bb950e68b400ab4f65f8@xxxxxxxxxxxxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@xxxxxxxxx
    Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@xxxxxxx
    Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 71a6ea62c3be7..4ff0b927230c2 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -234,12 +234,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *name)
 
 /* -------------------------------------------------------- */
 
+#define MAX_CELL_PROCESSES_IN_QUEUE	1000
+
 void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
 {
 	unsigned long flags;
 	struct snd_seq_event_cell *cell;
 	snd_seq_tick_time_t cur_tick;
 	snd_seq_real_time_t cur_time;
+	int processed = 0;
 
 	if (q == NULL)
 		return;
@@ -262,6 +265,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
 		if (!cell)
 			break;
 		snd_seq_dispatch_event(cell, atomic, hop);
+		if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE)
+			goto out; /* the rest processed at the next batch */
 	}
 
 	/* Process time queue... */
@@ -271,14 +276,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
 		if (!cell)
 			break;
 		snd_seq_dispatch_event(cell, atomic, hop);
+		if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE)
+			goto out; /* the rest processed at the next batch */
 	}
 
+ out:
 	/* free lock */
 	spin_lock_irqsave(&q->check_lock, flags);
 	if (q->check_again) {
 		q->check_again = 0;
-		spin_unlock_irqrestore(&q->check_lock, flags);
-		goto __again;
+		if (processed < MAX_CELL_PROCESSES_IN_QUEUE) {
+			spin_unlock_irqrestore(&q->check_lock, flags);
+			goto __again;
+		}
 	}
 	q->check_blocked = 0;
 	spin_unlock_irqrestore(&q->check_lock, flags);