Re: [PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[Takashi Iwai]

On Wed, 04 Nov 2026 07:13:11 +0100,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@xxxxxxxxxx>
> 
> snd_info_entry_write() computes maxsize as entry->size - pos without
> first checking whether pos has already reached entry->size.  If a write
> is issued with an offset beyond the entry size, the subtraction
> underflows and count is left unclamped, so the write callback is called
> with an out-of-range offset and the original count.
> 
> The read path already handles this case by returning 0 when
> pos >= entry->size.  Add the same check to the write path.
> 
> Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common layer")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Bob Song <songxiebing@xxxxxxxxxx>

This was already addressed in Christian's recent patchset.
https://lore.kernel.org/20261102-work-procfs-bugfixes-v1-9-59422ed3e465@xxxxxxxxxx

(... and he mentioned that return 0 would lead to endless stdio
retry, too.)


thanks,

Takashi

> ---
>  sound/core/info.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/core/info.c b/sound/core/info.c
> index 3b8ccda04e1a..676b06e0d463 100644
> --- a/sound/core/info.c
> +++ b/sound/core/info.c
> @@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
>  	pos = *offset;
>  	if (!valid_pos(pos, count))
>  		return -EIO;
> +	if (pos >= entry->size)
> +		return 0;
>  	if (count > 0) {
>  		size_t maxsize = entry->size - pos;
>  		count = min(count, maxsize);
> -- 
> 2.25.1
>