Commit 01c3cc3182 for qemu.org

commit 01c3cc31821477954b1b1869c3f70e463907a329
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:23 2026 +0400

    audio/pwaudio: handle negative avail in qpw_write and qpw_buffer_get_free

    qpw_write() and qpw_buffer_get_free() do not handle negative avail
    (highwater_mark - filled), which can occur transiently. In
    qpw_buffer_get_free(), clamp to zero. In qpw_write(), bail out early
    and fix the signed/unsigned comparison with len.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: c2d3d1c29415 ("audio/pwaudio.c: Add Pipewire audio backend for QEMU")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-9-ccbef537cbeb@redhat.com>

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index a8c18b9ecf..8b3faae8a9 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -286,6 +286,9 @@ static size_t qpw_buffer_get_free(HWVoiceOut *hw)

     filled = spa_ringbuffer_get_write_index(&v->ring, &index);
     avail = v->highwater_mark - filled;
+    if (avail < 0) {
+        avail = 0;
+    }

 done_unlock:
     pw_thread_loop_unlock(c->thread_loop);
@@ -312,8 +315,12 @@ qpw_write(HWVoiceOut *hw, void *data, size_t len)
     avail = v->highwater_mark - filled;

     trace_pw_write(filled, avail, index, len);
+    if (avail <= 0) {
+        len = 0;
+        goto done_unlock;
+    }

-    if (len > avail) {
+    if (len > (size_t)avail) {
         len = avail;
     }