Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1

From	Dmitry Vyukov <dvyukov@google.com>
Newsgroups	linux.kernel
Subject	Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1
Date	2016-02-03 14:30 +0100
Message-ID	<qY5Fo-2vi-13@gated-at.bofh.it> (permalink)
References	<qY1s6-83z-25@gated-at.bofh.it> <qY24O-aO-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Feb 3, 2016 at 10:35 AM, Takashi Iwai <tiwai@suse.de> wrote:
> On Wed, 03 Feb 2016 09:57:50 +0100,
> Dmitry Vyukov wrote:
>>
>> Hello,
>>
>> The following program triggers an out-of-bounds write in
>> snd_rawmidi_kernel_write1 (run in parallel loop). It seems to try to
>> copy -1 bytes (aka 4GB) from user space into kernel smashing all on
>> its way.
>
> What card is /dev/midi3?  Please check /proc/asound/cards.
> Is it MTPAV?

Yes, it was MTPAV. There is only generic code in the stack traces, so
I though it may be a generic issue. Though, of course, the driver
could mess things already.
I've dropped CONFIG_SND_MTPAV now.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

sound: out-of-bounds write in snd_rawmidi_kernel_write1 Dmitry Vyukov <dvyukov@google.com> - 2016-02-03 10:00 +0100
  Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Takashi Iwai <tiwai@suse.de> - 2016-02-03 10:40 +0100
    Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Takashi Iwai <tiwai@suse.de> - 2016-02-03 10:50 +0100
      Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Takashi Iwai <tiwai@suse.de> - 2016-02-03 12:40 +0100
        Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Takashi Iwai <tiwai@suse.de> - 2016-02-03 13:10 +0100
          Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Dmitry Vyukov <dvyukov@google.com> - 2016-02-03 14:40 +0100
            Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Takashi Iwai <tiwai@suse.de> - 2016-02-03 15:30 +0100
    Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1 Dmitry Vyukov <dvyukov@google.com> - 2016-02-03 14:30 +0100

csiph-web