On Mon, 02 Nov 2026 15:21:24 +0100,
Christian Brauner wrote:
>
> snd_info_entry_write() clamps the count to what is left of the entry
> by computing entry->size - pos as a size_t. For a position past the end
> that wraps and the write goes to the driver unclamped, for opl4 into
> sample memory outside of what the entry covers. At the end of the entry
> the driver gets a count of 0 and vmalloc(0) warns. Before the clamp
> moved into the common code the driver ignored such writes. Fail them
> with -ENOSPC instead, like a block device does at the end of the
> device. Returning 0 would make writers that use stdio retry forever.
>
> Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common
> layer")
> Cc: [email protected]
> Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Reviewed-by: Takashi Iwai <[email protected]>
thanks,
Takashi
> ---
> sound/core/info.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/sound/core/info.c b/sound/core/info.c
> index c4d57d0809ad..982087bc8575 100644
> --- a/sound/core/info.c
> +++ b/sound/core/info.c
> @@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file,
> const char __user *buffer
> pos = *offset;
> if (!valid_pos(pos, count))
> return -EIO;
> + if (pos >= entry->size)
> + return count ? -ENOSPC : 0;
> if (count > 0) {
> size_t maxsize = entry->size - pos;
> count = min(count, maxsize);
>
> --
> 2.53.0
>
