diff options
| author | HyeongJun An <sammiee5311@gmail.com> | 2026-06-06 13:09:13 +0900 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-06-06 18:12:31 +0200 |
| commit | 2b7bd6f548292aec92a386deebe62324d21d62a9 (patch) | |
| tree | 2e3d4f20f1554efd27f6a2a6aafe39a3283e29c4 | |
| parent | 1516134cb65526aba5319bb446c296fc8a192f84 (diff) | |
| download | linux-2b7bd6f548292aec92a386deebe62324d21d62a9.tar.gz linux-2b7bd6f548292aec92a386deebe62324d21d62a9.zip | |
ALSA: seq: Fix partial userptr event expansion
snd_seq_expand_var_event_at() clamps the number of bytes to copy to the
remaining variable-event length, but passes the original buffer size to
expand_var_event().
For SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the
size argument from userspace. On the final chunk, when the remaining
event data is shorter than the caller's buffer, this can read past the
declared event data and can spuriously fail with -EFAULT if the extra
bytes cross an unmapped page.
Pass the clamped length instead. The chained and kernel-backed paths
already reclamp in dump_var_event(), but the user-pointer path handles
the size directly.
Fixes: ea46f79709b6 ("ALSA: seq: Add snd_seq_expand_var_event_at() helper")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260606040913.230213-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/core/seq/seq_memory.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index aaf808316c30..ca9f6db0022c 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -211,7 +211,7 @@ int snd_seq_expand_var_event_at(const struct snd_seq_event *event, int count, len -= offset; if (len > count) len = count; - err = expand_var_event(event, offset, count, buf, true); + err = expand_var_event(event, offset, len, buf, true); if (err < 0) return err; return len; |