diff options
| author | Takashi Iwai <[email protected]> | 2023-09-05 10:12:10 +0200 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2023-09-05 10:13:46 +0200 |
| commit | 86496fd4a2fabb7c978fdaca2d4b718207a96d36 (patch) | |
| tree | e460ea9fbcdcdbc864fdce8a84cada363352191d | |
| parent | b1757fa30ef14f254f4719bf6f7d54a4c8207216 (diff) | |
ALSA: seq: Fix snd_seq_expand_var_event() call to user-space
The recent fix to clear the padding bytes at
snd_seq_expand_var_event() broke the read to user-space with
in_kernel=0 parameter. For user-space address, it has to use
clear_user() instead of memset().
Fixes: f80e6d60d677 ("ALSA: seq: Clear padded bytes at expanding events")
Reported-and-tested-by: Ash Holland <[email protected]>
Closes: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
| -rw-r--r-- | sound/core/seq/seq_memory.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 174585bf59d2..b603bb93f896 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -187,8 +187,13 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char err = expand_var_event(event, 0, len, buf, in_kernel); if (err < 0) return err; - if (len != newlen) - memset(buf + len, 0, newlen - len); + if (len != newlen) { + if (in_kernel) + memset(buf + len, 0, newlen - len); + else if (clear_user((__force void __user *)buf + len, + newlen - len)) + return -EFAULT; + } return newlen; } EXPORT_SYMBOL(snd_seq_expand_var_event); |