Unbounded exponential backtracking in hdaa_audio_trace_as_out/trace_dac DAC-assignment search — kernel livelock at attach/reconfig with hostile codec topology

Summary

hdaa_audio_trace_as_out enumerates DAC-per-pin assignments by exhaustive backtracking: for each pin it retries every reachable DAC nid >= min, recursing per pin (up to 16 pins/association). Worst case is the number of injective assignments (~31P16 ~ 10^24 for a hostile codec with 31 converters), each candidate itself a full graph walk in hdaa_audio_trace_dac (recursion over <=32 conns, depth <=10 - alone up to 32^10 paths on a crafted cyclic-ish fan-out). A codec that makes only the last pin untraceable (its sole reachable DAC already bound) forces exhaustive exploration: the kernel spins forever inside hdaa_configure with hdaa_lock held at attach. Same primitive applies to the input tracing. Hostile/compromised HDA codec (PCIe card, QEMU host, or compromised audio firmware); not triggerable by unprivileged users; real codecs converge. Speculative (QEMU's benign hda-duplex codec traces with no backtracking; expressing the pathological topology requires a custom codec model). Fix: work budget or per-(nid,min) memoization.