Re: [PATCH] ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

[Takashi Iwai]

On Wed, 03 Dec 2025 05:27:03 +0100,
Junrui Luo wrote:
> 
> The DSP event handling code in hwdep_read() could write more bytes to
> the user buffer than requested, when a user provides a buffer smaller
> than the event header size (8 bytes).
> 
> Fix by using min_t() to clamp the copy size, This ensures we never copy
> more than the user requested.
> 
> Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
> Reported-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
> Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
> Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>

Applied now.  Thanks.

BTW, the code there has another bug; the loop of put_user() above your
change doesn't check whether it has an enough remaining size.  When
count isn't aligned with 4 bytes, it might cause a similar overwrite.
It has to be corrected, too.


Takashi