Re: [PATCH] ALSA: seq: Fix partial userptr event expansion

[Takashi Iwai <tiwai@suse.de>]

On Sat, 06 Jun 2026 06:09:13 +0200,
HyeongJun An wrote:
> 
> snd_seq_expand_var_event_at() clamps the number of bytes to copy to the
> remaining variable-event length, but passes the original buffer size to
> expand_var_event().
> 
> For SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the
> size argument from userspace.  On the final chunk, when the remaining
> event data is shorter than the caller's buffer, this can read past the
> declared event data and can spuriously fail with -EFAULT if the extra
> bytes cross an unmapped page.
> 
> Pass the clamped length instead.  The chained and kernel-backed paths
> already reclamp in dump_var_event(), but the user-pointer path handles
> the size directly.
> 
> Fixes: ea46f79709b6 ("ALSA: seq: Add snd_seq_expand_var_event_at() helper")
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>

Applied to for-next branch now.  Thanks.


Takashi