lkml.org 
[lkml]   [2016]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: sound: out-of-bounds write in snd_rawmidi_kernel_write1
On Wed, Feb 3, 2016 at 10:35 AM, Takashi Iwai <tiwai@suse.de> wrote:
> On Wed, 03 Feb 2016 09:57:50 +0100,
> Dmitry Vyukov wrote:
>>
>> Hello,
>>
>> The following program triggers an out-of-bounds write in
>> snd_rawmidi_kernel_write1 (run in parallel loop). It seems to try to
>> copy -1 bytes (aka 4GB) from user space into kernel smashing all on
>> its way.
>
> What card is /dev/midi3? Please check /proc/asound/cards.
> Is it MTPAV?

Yes, it was MTPAV. There is only generic code in the stack traces, so
I though it may be a generic issue. Though, of course, the driver
could mess things already.
I've dropped CONFIG_SND_MTPAV now.

\
 
 \ /
  Last update: 2016-02-03 15:21    [W:0.053 / U:0.480 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site