Re: [PATCH] ALSA: seq: Restore the delivery error code in the bounce event

[Takashi Iwai]

On Wed, 12 Aug 2026 13:32:36 +0200,
HyeongJun An wrote:
> 
> Commit efc86691e4d8 ("ALSA: seq: Fix kernel heap address leak in
> bounce_error_event()") moved the data.quote.value assignment into the
> kernel client branch.  A user client that sets SNDRV_SEQ_FILTER_BOUNCE
> used to get the delivery error code there.  Now it gets none, and
> nothing else reports it, because a queued event's write() has already
> returned success by the time delivery fails.
> 
> Send struct snd_seq_event_bounce instead, the error code followed by the
> original event record, which is what the UAPI header has described all
> along.  Store the negative errno.  The kernel client branch negates it
> only because data.quote.value is an unsigned short.
> 
> The payload grows from 28 to 32 bytes.  The snd_seq_read() rounds a
> variable-length payload up to a multiple of the event size, so a legacy
> client now needs an 84 byte buffer instead of 56.  That is what any
> event carrying 29 payload bytes has always needed.  A UMP client reads
> 64 bytes either way.
> 
> Drop the stale promise to copy the external data after the event record
> as well.  That was never implemented, and bounce_error_event() runs with
> atomic set from the timer interrupt.
> 
> Fixes: efc86691e4d8 ("ALSA: seq: Fix kernel heap address leak in bounce_error_event()")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@xxxxxxxxx>
> ---
> Notes for the reviewer, not part of the change.
> 
> A UMP event does not fit the payload.  A struct snd_seq_ump_event is 32
> bytes while quoted.event is 28, so ump[3] is dropped while
> SNDRV_SEQ_EVENT_UMP stays set in the copy.  That is already true today,
> but this locks it into the UAPI.  Clear the flag, skip bouncing UMP
> events, or a different layout?  I did not want to guess.
> 
> The err field carries the negative errno.  Nothing has ever produced or
> consumed this struct, so the sign is being chosen here for the first
> time.  Say if you want the positive value instead.
> 
> I could not check whether any user space sets SNDRV_SEQ_FILTER_BOUNCE,
> or what buffer size it reads with.

Thanks, now I see what you meant previously.

I belive that struct snd_seq_event_bounce is dead, not actually used.
So, it's better to stick with the existing snd_seq_ev_quote even
though we lose the error code in user-space delivery.  The definition
of snd_seq_event_bounce can be dropped for avoiding confusion in
future, too.


Takashi