This is a note to let you know that I've just added the patch titled ALSA: seq: Fix OOB-reads from strlcpy to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: alsa-seq-fix-oob-reads-from-strlcpy.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 212ac181c158c09038c474ba68068be49caecebb Mon Sep 17 00:00:00 2001 From: Zubin Mithra <zsm@xxxxxxxxxxxx> Date: Thu, 4 Apr 2019 14:33:55 -0700 Subject: ALSA: seq: Fix OOB-reads from strlcpy From: Zubin Mithra <zsm@xxxxxxxxxxxx> commit 212ac181c158c09038c474ba68068be49caecebb upstream. When ioctl calls are made with non-null-terminated userspace strings, strlcpy causes an OOB-read from within strlen. Fix by changing to use strscpy instead. Signed-off-by: Zubin Mithra <zsm@xxxxxxxxxxxx> Reviewed-by: Guenter Roeck <groeck@xxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- sound/core/seq/seq_clientmgr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info /* fill the info fields */ if (client_info->name[0]) - strlcpy(client->name, client_info->name, sizeof(client->name)); + strscpy(client->name, client_info->name, sizeof(client->name)); client->filter = client_info->filter; client->event_lost = client_info->event_lost; @@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(st /* set queue name */ if (!info->name[0]) snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue); - strlcpy(q->name, info->name, sizeof(q->name)); + strscpy(q->name, info->name, sizeof(q->name)); snd_use_lock_free(&q->use_lock); return 0; @@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info( queuefree(q); return -EPERM; } - strlcpy(q->name, info->name, sizeof(q->name)); + strscpy(q->name, info->name, sizeof(q->name)); queuefree(q); return 0; Patches currently in stable-queue which might be from zsm@xxxxxxxxxxxx are queue-4.19/netfilter-nfnetlink_cttimeout-pass-default-timeout-p.patch queue-4.19/netfilter-nfnetlink_cttimeout-fetch-timeouts-for-udp.patch queue-4.19/alsa-seq-fix-oob-reads-from-strlcpy.patch