3 Feb
2016
3 Feb
'16
3:25 p.m.
On Wed, Feb 3, 2016 at 10:35 AM, Takashi Iwai tiwai@suse.de wrote:
On Wed, 03 Feb 2016 09:57:50 +0100, Dmitry Vyukov wrote:
Hello,
The following program triggers an out-of-bounds write in snd_rawmidi_kernel_write1 (run in parallel loop). It seems to try to copy -1 bytes (aka 4GB) from user space into kernel smashing all on its way.
What card is /dev/midi3? Please check /proc/asound/cards. Is it MTPAV?
Yes, it was MTPAV. There is only generic code in the stack traces, so I though it may be a generic issue. Though, of course, the driver could mess things already. I've dropped CONFIG_SND_MTPAV now.