Re: [PATCH] ALSA: seq: dummy: fix UMP event stack overread

[Takashi Iwai <tiwai@suse.de>]

On Fri, 05 Jun 2026 10:02:04 +0200,
Kyle Zeng wrote:
> 
> The dummy sequencer port forwards events by copying an incoming
> struct snd_seq_event into a stack temporary, rewriting source and
> destination, and dispatching the temporary to subscribers. That legacy
> event storage is smaller than struct snd_seq_ump_event.
> 
> When a UMP event reaches the dummy client, the copy leaves the UMP flag
> set but only provides legacy-sized stack storage. The subscriber
> delivery path then uses snd_seq_event_packet_size() and copies a
> UMP-sized packet from that stack object, reading past the end of the
> temporary.
> 
> Use the existing union __snd_seq_event storage and copy the packet size
> reported for the incoming event before rewriting the common routing
> fields. This preserves the full UMP packet for UMP events while keeping
> legacy event handling unchanged.
> 
> Fixes: 32cb23a0f911 ("ALSA: seq: dummy: Allow UMP conversion")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Applied now.  Thanks.


Takashi