From nobody Mon Jun 8 06:36:53 2026 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 45F321FFC48 for ; Sat, 6 Jun 2026 04:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780718962; cv=none; b=u62CbKuwR5R67S6LOulqPIgLvMcfhcaS0d/Ca2rs13CCKcSgInbmSaWTTQmIZrUpwxeF23c4YYy+mKKqPLUSkGd8IBL0/zFyoRYGntBtPyXtg/43x71/rdhq33LjlEaj2WxkMDmd27CrLkFam3ztFNWFTYlX6BG86MZwWctghPw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780718962; c=relaxed/simple; bh=DMg733VlwSWJY1Ldjkhq7ozVbVRULvI3inFeZ56lOCI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YheYzqPWK/40Dlu41W1457YwopWsKxCz2TrSHJwdszaRIejUzqY5/PQQZAaKCJAd4klL2Q769BzZRe6k1i3uO069wX4P6h55uaeXqiSeXmo0XaQWzdMhYCdRpPvGmqTWRDQzUOY+j+21kLIIf44QLX0i74/sMSicsRClqVFK1Kc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s+LZIwIm; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s+LZIwIm" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2bf237e1433so29664205ad.1 for ; Fri, 05 Jun 2026 21:09:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780718959; x=1781323759; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=3FsbdGlRpt8inQhJg6VQV5r05iQNTiYYvCDbh44wz9w=; b=s+LZIwImUvsI6PwsltQTIRgjxsiQGnlaJ2piTXHSDObgH5TJHcNS6TDBDGO1xRhYls 0zbtVtKHar669Jz4DCtmjslfDX/ganUex5EqGGsr591AvrRU18eSNDlr9wjm5FSKLKCu hjHJpFQqLEoTdUe7p2hT3oxIjnnCY9e3gDbSOWAKKluX4LS5Ey4z7XHCNwpHDNZOe/Rn 9BJTAqOwyVU2R/jmheeK2ZRG3/vZHM0oFWC82Se4fMd7msgXlOCVo1iTmNRafTWGeVQ4 gqjH836dX7T5nTi3sEGxYXMg3zCab2gxNqL/f0AqxZIrvg0Dxl1zjpf/fFoavlUXW782 FU/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780718959; x=1781323759; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=3FsbdGlRpt8inQhJg6VQV5r05iQNTiYYvCDbh44wz9w=; b=Z35fGeQ5Qszk/03FvMcBUu5hliUakgOsNpCltRpsGeBA+dQ3SrrV4bJJJzfCA+J0cg FEo9cXSdnNp1OvC+bbxIY4WKxM3AL/5/UyPmpGcJvnlMiM5sc/gjZ+ydQPZbIRzEgJca +yEgIvDXuACl1OZQS3hhfWcMrWCjsjuLd7Dfav/coY9OoaPpbcxSoZIk7ZJk3UhAl/yS bMIUubTqf5c1+AXx8yyEviusY3fqokBNMALratSjyl6MndWewoAKVKIVpuhpnwaRyc83 m4m3KfFcnJtf67Z5R+xsaQpKy9hvUsCtMC75JwcDdUo/xCQ4IMZ1eF02zlt684OVsBr+ ifnw== X-Forwarded-Encrypted: i=1; AFNElJ+MHOAiK58wq/QPDqHIo9agL8kmk8KTBhwdOpVAyC1BVf+KWux6C8IhJvhA6lrsIIhmSN1SMG+wCEoRdSQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzNDLiRvwCefX3BKOqpuASrOilbHGb5Yf5nk1cnfJWp7Uc0W4Ii U7EVhia+siDwRyDg5Y2Aep/DxFfFBCM0d4gqF6skbdksHZtVjj3g7sZy X-Gm-Gg: Acq92OG53ONUDqS1hkTvbwbn0vLVdLaexMKv5P1jlZh7ugKXscDgC5QkF8bPqlD3tPX SgVNH83Vjo4wcTCETN8hQNJ37wWKJ7xK6pihcYQLhYpJtVyQBNDqK0TUGSglgYJBJMqVPkwHr0U ttlUaFXati3KQmfht+Ixc2ui6+6fV5azUxqKjMF+Jk99bp0Da6fHdt8A6EaoMg2QuPhaSL7uQdN znu25LQBSyS1W+6VARdlwFIbFtuTNpBkLN4IzY8/eKXe3DDJ0Gi1lvhPtJVbhO7dULvLdZvInQb IjrUTjwPUuafwDzmwxfGvR/pEBJKLHwWEMxZYHeYh4wPiyRymyfnsylDQpU6wFu3010jTpeOFIp BkqUhh4mBoOmqnVE0u+lhMDrIBGgUm3miMEim+MMDdyq8YdPFi99xGhoI/BiBJSXFiOM26tR81J B9ZQV3kg2Bj5qWeOQCEnEKJB4zgRQsv4MlbQS/ImxN4J5aNyU7hFIdwHUKWalTpQJ+LqsoMy3UL Pz/YFnWhcm9jnRdmNuGgkYC+Fk= X-Received: by 2002:a17:903:faf:b0:2c0:db23:4c4 with SMTP id d9443c01a7336-2c1e82191bamr72569215ad.16.1780718959509; Fri, 05 Jun 2026 21:09:19 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c166396fa9sm107511895ad.66.2026.06.05.21.09.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 Jun 2026 21:09:18 -0700 (PDT) From: HyeongJun An To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, HyeongJun An Subject: [PATCH] ALSA: seq: Fix partial userptr event expansion Date: Sat, 6 Jun 2026 13:09:13 +0900 Message-ID: <20260606040913.230213-1-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snd_seq_expand_var_event_at() clamps the number of bytes to copy to the remaining variable-event length, but passes the original buffer size to expand_var_event(). For SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the size argument from userspace. On the final chunk, when the remaining event data is shorter than the caller's buffer, this can read past the declared event data and can spuriously fail with -EFAULT if the extra bytes cross an unmapped page. Pass the clamped length instead. The chained and kernel-backed paths already reclamp in dump_var_event(), but the user-pointer path handles the size directly. Fixes: ea46f79709b6 ("ALSA: seq: Add snd_seq_expand_var_event_at() helper") Signed-off-by: HyeongJun An --- sound/core/seq/seq_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index aaf808316c30..ca9f6db0022c 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -211,7 +211,7 @@ int snd_seq_expand_var_event_at(const struct snd_seq_ev= ent *event, int count, len -=3D offset; if (len > count) len =3D count; - err =3D expand_var_event(event, offset, count, buf, true); + err =3D expand_var_event(event, offset, len, buf, true); if (err < 0) return err; return len; --=20 2.43.0