* [PATCH] ALSA: firewire-motu: add bounds check in put_user loop for DSP events
@ 2025-12-09 5:16 Junrui Luo
2025-12-09 7:09 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Junrui Luo @ 2025-12-09 5:16 UTC (permalink / raw)
To: Clemens Ladisch, Takashi Sakamoto, Jaroslav Kysela, Takashi Iwai
Cc: Takashi Iwai, linux-sound, linux-kernel, Junrui Luo
In the DSP event handling code, a put_user() loop copies event data.
When the user buffer size is not aligned to 4 bytes, it could overwrite
beyond the buffer boundary.
Fix by adding a bounds check before put_user().
Suggested-by: Takashi Iwai <tiwai@suse.de>
Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
sound/firewire/motu/motu-hwdep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c
index 6675b23aad69..89dc436a0652 100644
--- a/sound/firewire/motu/motu-hwdep.c
+++ b/sound/firewire/motu/motu-hwdep.c
@@ -75,7 +75,7 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
while (consumed < count &&
snd_motu_register_dsp_message_parser_copy_event(motu, &ev)) {
ptr = (u32 __user *)(buf + consumed);
- if (put_user(ev, ptr))
+ if (consumed + sizeof(ev) > count || put_user(ev, ptr))
return -EFAULT;
consumed += sizeof(ev);
}
---
base-commit: 210d77cca3d0494ed30a5c628b20c1d95fa04fb1
change-id: 20251209-fixes-28e18627cc79
Best regards,
--
Junrui Luo <moonafterrain@outlook.com>
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ALSA: firewire-motu: add bounds check in put_user loop for DSP events
2025-12-09 5:16 [PATCH] ALSA: firewire-motu: add bounds check in put_user loop for DSP events Junrui Luo
@ 2025-12-09 7:09 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2025-12-09 7:09 UTC (permalink / raw)
To: Junrui Luo
Cc: Clemens Ladisch, Takashi Sakamoto, Jaroslav Kysela, Takashi Iwai,
Takashi Iwai, linux-sound, linux-kernel
On Tue, 09 Dec 2025 06:16:41 +0100,
Junrui Luo wrote:
>
> In the DSP event handling code, a put_user() loop copies event data.
> When the user buffer size is not aligned to 4 bytes, it could overwrite
> beyond the buffer boundary.
>
> Fix by adding a bounds check before put_user().
>
> Suggested-by: Takashi Iwai <tiwai@suse.de>
> Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Applied now. Thanks.
Takashi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-09 7:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-09 5:16 [PATCH] ALSA: firewire-motu: add bounds check in put_user loop for DSP events Junrui Luo
2025-12-09 7:09 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox