snd_info_entry_write() clamps the count to what is left of the entry
by computing entry->size - pos as a size_t. For a position past the end
that wraps and the write goes to the driver unclamped, for opl4 into
sample memory outside of what the entry covers. At the end of the entry
the driver gets a count of 0 and vmalloc(0) warns. Before the clamp
moved into the common code the driver ignored such writes. Fail them
with -ENOSPC instead, like a block device does at the end of the
device. Returning 0 would make writers that use stdio retry forever.
Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common
layer")
Cc: [email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>
---
sound/core/info.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/core/info.c b/sound/core/info.c
index c4d57d0809ad..982087bc8575 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file,
const char __user *buffer
pos = *offset;
if (!valid_pos(pos, count))
return -EIO;
+ if (pos >= entry->size)
+ return count ? -ENOSPC : 0;
if (count > 0) {
size_t maxsize = entry->size - pos;
count = min(count, maxsize);
--
2.53.0
