| Message ID | 20230905052631.18240-1-tiwai@suse.de |
|---|---|
| State | Accepted |
| Commit | 86496fd4a2fabb7c978fdaca2d4b718207a96d36 |
| Headers | show |
| Series | ALSA: seq: Fix snd_seq_expand_var_event() call to user-space | expand |
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 174585bf59d2..94db3726864b 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -187,8 +187,12 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char err = expand_var_event(event, 0, len, buf, in_kernel); if (err < 0) return err; - if (len != newlen) - memset(buf + len, 0, newlen - len); + if (len != newlen) { + if (in_kernel) + memset(buf + len, 0, newlen - len); + else + clear_user((__force void __user *)buf + len, newlen - len); + } return newlen; } EXPORT_SYMBOL(snd_seq_expand_var_event);
The recent fix to clear the padding bytes at snd_seq_expand_var_event() broke the read to user-space with in_kernel=0 parameter. For user-space address, it has to use clear_user() instead of memset(). Fixes: f80e6d60d677 ("ALSA: seq: Clear padded bytes at expanding events") Reported-and-tested-by: Ash Holland <ash@sorrel.sh> Closes: https://lore.kernel.org/r/8a555319-9f31-4ea2-878f-adc338bc40d4@sorrel.sh Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/core/seq/seq_memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)