[PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[songxiebing]

From: Bob Song <songxiebing@xxxxxxxxxx>

snd_info_entry_write() computes maxsize as entry->size - pos without
first checking whether pos has already reached entry->size.  If a write
is issued with an offset beyond the entry size, the subtraction
underflows and count is left unclamped, so the write callback is called
with an out-of-range offset and the original count.

The read path already handles this case by returning 0 when
pos >= entry->size.  Add the same check to the write path.

Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common layer")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Bob Song <songxiebing@xxxxxxxxxx>
---
 sound/core/info.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/core/info.c b/sound/core/info.c
index 3b8ccda04e1a..676b06e0d463 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
 	pos = *offset;
 	if (!valid_pos(pos, count))
 		return -EIO;
+	if (pos >= entry->size)
+		return 0;
 	if (count > 0) {
 		size_t maxsize = entry->size - pos;
 		count = min(count, maxsize);
-- 
2.25.1