Re: [PATCH] ALSA: pcm: oss: Use snd_pcm_kernel_write() in snd_pcm_oss_sync()

[Jiakai Xu]

Thank you for your review, Takashi.

> Thanks for the patch.  I believe the problem is rather in
> do_transfer() setting up a bogus iter for silencing unnecessarily.
> So it's a bug introduced in the commit cf393babb37a ("ALSA: pcm: Add
> copy ops with iov_iter").

I agree with your analysis. The root cause is indeed in
interleaved_copy() — it should not pass a NULL data pointer to
do_transfer(), which then unnecessarily constructs an iov_iter.

> Could you verify whether the change below works instead?
> noninterleaved_copy() has already the handling of NULL data.

Unfortunately, this crash was discovered through fuzzing, and
the fuzzer did not generate a reproducer. As a result, I am unable to
test the fix directly. However, the fix looks correct to me.

Best regards,
Jiakai