Commit 7cdccb44fc for qemu.org

commit 7cdccb44fc0b5a86580ad9015b32f0b82f217405
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:21 2026 +0400

    audio/pwaudio: clamp overrun writes to remaining ring buffer space

    On overrun in both capture and playback paths, the code logs an error
    but proceeds to write the full unclamped size. This advances the write
    index past read_index + RINGBUFFER_SIZE, causing filled to exceed the
    buffer capacity on subsequent calls. Once in that state, avail goes
    negative and the signed/unsigned comparison fails to clamp further
    writes, leaving the ring buffer in a degenerate state.

    Clamp to the remaining space so the write index stays within bounds.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: c2d3d1c29415 ("audio/pwaudio.c: Add Pipewire audio backend for QEMU")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-7-ccbef537cbeb@redhat.com>

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index af360e2ec5..1105e920f3 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -188,6 +188,7 @@ capture_on_process(void *data)
         if ((uint32_t) filled + n_bytes > RINGBUFFER_SIZE) {
             error_report("%p: overrun write:%u filled:%d + size:%u > max:%u",
             p, index, filled, n_bytes, RINGBUFFER_SIZE);
+            n_bytes = RINGBUFFER_SIZE - (uint32_t)filled;
         }
     }
     spa_ringbuffer_write_data(&v->ring,
@@ -318,6 +319,7 @@ qpw_write(HWVoiceOut *hw, void *data, size_t len)
         if ((uint32_t) filled + len > RINGBUFFER_SIZE) {
             error_report("%p: overrun write:%u filled:%d + size:%zu > max:%u",
             pw, index, filled, len, RINGBUFFER_SIZE);
+            len = RINGBUFFER_SIZE - (uint32_t)filled;
         }
     }