The branch releng/15.0 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=10858b0162dc434d1b6430d7583a88a83c8012d5
commit 10858b0162dc434d1b6430d7583a88a83c8012d5 Author: Christos Margiolis <[email protected]> AuthorDate: 2025-10-27 11:30:29 +0000 Commit: Colin Percival <[email protected]> CommitDate: 2025-11-03 20:28:38 +0000 snd_dummy: Round channel pointer after each write Otherwise we go out of bounds and keep incrementing endlessly. Approved by: re (cperciva) Sponsored by: The FreeBSD Foundation MFC after: 4 days Differential Revision: https://reviews.freebsd.org/D53337 (cherry picked from commit 364864ea91abbd8a9a79578168fa5d34e05200a7) (cherry picked from commit 4eac02b29f56f35d17f3cb2104e5b952841e83b9) --- sys/dev/sound/dummy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/dev/sound/dummy.c b/sys/dev/sound/dummy.c index 4df5b112d3f4..54320aab8496 100644 --- a/sys/dev/sound/dummy.c +++ b/sys/dev/sound/dummy.c @@ -104,9 +104,10 @@ dummy_chan_io(void *arg) ch = &sc->chans[i]; if (!ch->run) continue; - if (ch->dir == PCMDIR_PLAY) + if (ch->dir == PCMDIR_PLAY) { ch->ptr += sndbuf_getblksz(ch->buf); - else + ch->ptr %= sndbuf_getsize(ch->buf); + } else sndbuf_fillsilence(ch->buf); snd_mtxunlock(sc->lock); chn_intr(ch->chan);
