commit 132d358b183ac6ad8b3fea32ad5e0663456d18d1
author Takashi Iwai <tiwai@suse.de> Tue Nov 07 16:05:24 2017 +0100
committer Takashi Iwai <tiwai@suse.de> Tue Nov 07 16:05:24 2017 +0100
tree d8a8493cf13d43f4ed5e8e6d96b57b7de45ef195
parent 3510c7aa069aa83a2de6dab2b41401a198317bdc

ALSA: seq: Fix OSS sysex delivery in OSS emulation

The SYSEX event delivery in OSS sequencer emulation assumed that the
event is encoded in the variable-length data with the straight
buffering.  This was the normal behavior in the past, but during the
development, the chained buffers were introduced for carrying more
data, while the OSS code was left intact.  As a result, when a SYSEX
event with the chained buffer data is passed to OSS sequencer port,
it may end up with the wrong memory access, as if it were having a too
large buffer.

This patch addresses the bug, by applying the buffer data expansion by
the generic snd_seq_dump_var_event() helper function.

Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Mark Salyzyn <salyzyn@android.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>