From: Takashi Iwai <tiwai@suse.de>
To: Kyle Zeng <kylebot@openai.com>
Cc: linux-sound@vger.kernel.org, tiwai@suse.de
Subject: Re: [PATCH] ALSA: seq: Clear variable event pointer on read
Date: Sun, 07 Jun 2026 09:24:34 +0200 [thread overview]
Message-ID: <87ik7usthp.wl-tiwai@suse.de> (raw)
In-Reply-To: <20260607004129.61345-1-kylebot@openai.com>
On Sun, 07 Jun 2026 02:41:29 +0200,
Kyle Zeng wrote:
>
> snd_seq_read() copies a queued variable-length event header to userspace
> before expanding the payload. Queued variable-length events use
> SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first
> extension cell.
>
> The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the
> copy, but it leaves data.ext.ptr untouched. A userspace sequencer client
> can therefore write a direct variable event to itself and read back the
> extension-cell kernel address from the returned header.
>
> Clear the temporary header pointer before copy_to_user(). The original
> queued event remains unchanged and is still passed to
> snd_seq_expand_var_event(), so payload expansion keeps using the
> internal chain.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
Applied to for-next branch now. Thanks.
Takashi
prev parent reply other threads:[~2026-06-07 7:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-07 0:41 [PATCH] ALSA: seq: Clear variable event pointer on read Kyle Zeng
2026-06-07 7:24 ` Takashi Iwai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ik7usthp.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=kylebot@openai.com \
--cc=linux-sound@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.