This is a note to let you know that I've just added the patch titled
ALSA: seq: Fix snd_seq_expand_var_event() call to user-space
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-seq-fix-snd_seq_expand_var_event-call-to-user-space.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 86496fd4a2fabb7c978fdaca2d4b718207a96d36 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Tue, 5 Sep 2023 10:12:10 +0200
Subject: ALSA: seq: Fix snd_seq_expand_var_event() call to user-space
From: Takashi Iwai <tiwai@xxxxxxx>
commit 86496fd4a2fabb7c978fdaca2d4b718207a96d36 upstream.
The recent fix to clear the padding bytes at
snd_seq_expand_var_event() broke the read to user-space with
in_kernel=0 parameter. For user-space address, it has to use
clear_user() instead of memset().
Fixes: f80e6d60d677 ("ALSA: seq: Clear padded bytes at expanding events")
Reported-and-tested-by: Ash Holland <ash@xxxxxxxxx>
Closes: https://lore.kernel.org/r/8a555319-9f31-4ea2-878f-adc338bc40d4@xxxxxxxxx
Link: https://lore.kernel.org/r/20230905052631.18240-1-tiwai@xxxxxxx
Link: https://lore.kernel.org/r/20230905081210.6731-1-tiwai@xxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/seq/seq_memory.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -187,8 +187,13 @@ int snd_seq_expand_var_event(const struc
err = expand_var_event(event, 0, len, buf, in_kernel);
if (err < 0)
return err;
- if (len != newlen)
- memset(buf + len, 0, newlen - len);
+ if (len != newlen) {
+ if (in_kernel)
+ memset(buf + len, 0, newlen - len);
+ else if (clear_user((__force void __user *)buf + len,
+ newlen - len))
+ return -EFAULT;
+ }
return newlen;
}
EXPORT_SYMBOL(snd_seq_expand_var_event);
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-6.5/alsa-hda-cirrus-fix-broken-audio-on-hardware-with-two-cs42l42-codecs.patch
queue-6.5/alsa-seq-fix-snd_seq_expand_var_event-call-to-user-space.patch
queue-6.5/alsa-ump-fix-wformat-truncation-warnings.patch
queue-6.5/alsa-ump-fill-group-names-for-legacy-rawmidi-substre.patch
queue-6.5/alsa-ac97-fix-possible-error-value-of-rac97.patch
queue-6.5/alsa-usb-audio-attach-legacy-rawmidi-after-probing-a.patch
queue-6.5/um-fix-hostaudio-build-errors.patch
queue-6.5/alsa-pcm-fix-missing-fixup-call-in-compat-hw_refine-ioctl.patch
queue-6.5/alsa-usb-audio-fix-potential-memory-leaks-at-error-path-for-ump-open.patch
queue-6.5/wifi-rtw89-fix-loading-of-compressed-firmware.patch
queue-6.5/alsa-ump-don-t-create-unused-substreams-for-static-b.patch
