[PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[songxiebing]

From: Bob Song <songxiebing@kylinos.cn>

snd_info_entry_write() computes maxsize as entry->size - pos without
first checking whether pos has already reached entry->size.  If a write
is issued with an offset beyond the entry size, the subtraction
underflows and count is left unclamped, so the write callback is called
with an out-of-range offset and the original count.

The read path already handles this case by returning 0 when
pos >= entry->size.  Add the same check to the write path.

Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common layer")
Cc: <stable@vger.kernel.org>
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
 sound/core/info.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/core/info.c b/sound/core/info.c
index 3b8ccda04e1a..676b06e0d463 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
 	pos = *offset;
 	if (!valid_pos(pos, count))
 		return -EIO;
+	if (pos >= entry->size)
+		return 0;
 	if (count > 0) {
 		size_t maxsize = entry->size - pos;
 		count = min(count, maxsize);
-- 
2.25.1

Re: [PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[Takashi Iwai]

On Wed, 04 Nov 2026 07:13:11 +0100,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@kylinos.cn>
> 
> snd_info_entry_write() computes maxsize as entry->size - pos without
> first checking whether pos has already reached entry->size.  If a write
> is issued with an offset beyond the entry size, the subtraction
> underflows and count is left unclamped, so the write callback is called
> with an out-of-range offset and the original count.
> 
> The read path already handles this case by returning 0 when
> pos >= entry->size.  Add the same check to the write path.
> 
> Fixes: d97e1b78239c ("ALSA: info - Check file position validity in common layer")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bob Song <songxiebing@kylinos.cn>

This was already addressed in Christian's recent patchset.
https://lore.kernel.org/20261102-work-procfs-bugfixes-v1-9-59422ed3e465@kernel.org

(... and he mentioned that return 0 would lead to endless stdio
retry, too.)


thanks,

Takashi

> ---
>  sound/core/info.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/core/info.c b/sound/core/info.c
> index 3b8ccda04e1a..676b06e0d463 100644
> --- a/sound/core/info.c
> +++ b/sound/core/info.c
> @@ -171,6 +171,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
>  	pos = *offset;
>  	if (!valid_pos(pos, count))
>  		return -EIO;
> +	if (pos >= entry->size)
> +		return 0;
>  	if (count > 0) {
>  		size_t maxsize = entry->size - pos;
>  		count = min(count, maxsize);
> -- 
> 2.25.1
> 

Re: [PATCH] ALSA: info: Fix maxsize underflow in snd_info_entry_write()

[songxiebing]

>This was already addressed in Christian's recent patchset.
>https://lore.kernel.org/20261102-work-procfs-bugfixes-v1-9-59422ed3e465@kernel.org
>
>(... and he mentioned that return 0 would lead to endless stdio
>retry, too.)
>
>
>thanks,
>
>Takashi

Thanks for your reply. The above approach is indeed better.

Bob