The cvt_legacy_sysex_to_ump() initialises only the first word of the
output packet and ORs the data bytes into it.  The second word is left
alone, and the conversion context is kept across calls, so it still
carries the previous packet's bytes.  Those stale bits corrupt the new
data.  Any SysEx longer than six data bytes is affected.

A SysEx with the twelve data bytes 01..0c comes out as:

  30160102 03040506
  30260708 0b0e0f0e

The second packet declares six data bytes and four of them are wrong,
inside the declared length.

The sibling cvt_legacy_cmd_to_ump() already clears the second word.  Do
the same here.

Fixes: 0b5288f5fe63 ("ALSA: ump: Add legacy raw MIDI support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 sound/core/ump_convert.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/core/ump_convert.c b/sound/core/ump_convert.c
index 0fe13d031656..85cc67de6330 100644
--- a/sound/core/ump_convert.c
+++ b/sound/core/ump_convert.c
@@ -258,6 +258,7 @@ static int cvt_legacy_sysex_to_ump(struct ump_cvt_to_ump *cvt,
 	else
 		status = UMP_SYSEX_STATUS_CONTINUE;
 	*data = ump_compose(UMP_MSG_TYPE_DATA, group, status, cvt->len);
+	data[1] = 0;
 	offset = 8;
 	for (i = 0; i < cvt->len; i++) {
 		*data |= cvt->buf[i] << offset;
-- 
2.43.0

On Sat, 08 Aug 2026 03:45:54 +0200,
HyeongJun An wrote:
> 
> The cvt_legacy_sysex_to_ump() initialises only the first word of the
> output packet and ORs the data bytes into it.  The second word is left
> alone, and the conversion context is kept across calls, so it still
> carries the previous packet's bytes.  Those stale bits corrupt the new
> data.  Any SysEx longer than six data bytes is affected.
> 
> A SysEx with the twelve data bytes 01..0c comes out as:
> 
>   30160102 03040506
>   30260708 0b0e0f0e
> 
> The second packet declares six data bytes and four of them are wrong,
> inside the declared length.
> 
> The sibling cvt_legacy_cmd_to_ump() already clears the second word.  Do
> the same here.
> 
> Fixes: 0b5288f5fe63 ("ALSA: ump: Add legacy raw MIDI support")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>

Applied to for-next branch.  Thanks.


Takashi