[alsa-devel] sound: WARNING in snd_rawmidi_kernel_write1

[Dmitry Vyukov]

Hello,

The following program triggers WARNING in snd_rawmidi_kernel_write1:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/uio.h>
#include <fcntl.h>

int main()
{
  int fd;
  struct iovec iov;

  fd = open("/dev/snd/midiC3D0", O_RDWR);
  iov.iov_base = "";
  iov.iov_len = 0;
  writev(fd, &iov, 1);
  return 0;
}


------------[ cut here ]------------
WARNING: CPU: 1 PID: 27775 at sound/core/rawmidi.c:1181
snd_rawmidi_kernel_write1+0x4e1/0x780()
Modules linked in:
CPU: 1 PID: 27775 Comm: syz-executor Not tainted 4.5.0-rc1+ #305
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff88003158f958[  845.661205] ------------[ cut
here ]------------
WARNING: CPU: 3 PID: 27781 at sound/core/rawmidi.c:1181
snd_rawmidi_kernel_write1+0x4e1/0x780()
Modules linked in:
 ffffffff82be11ad 0000000000000000
 ffff880032138000 ffffffff87188ec0 ffff88003158f998 ffffffff813536d9
 ffffffff8527ab31 ffffffff87188ec0 000000000000049d ffff8800321e4b88
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82be11ad>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff813536d9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff81353909>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff8527ab31>] snd_rawmidi_kernel_write1+0x4e1/0x780
sound/core/rawmidi.c:1181
 [<ffffffff8527cc93>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273
 [<ffffffff817b7611>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719
 [<ffffffff817bb478>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849
 [<ffffffff817bb696>] vfs_writev+0x86/0xc0 fs/read_write.c:886
 [<     inline     >] SYSC_writev fs/read_write.c:919
 [<ffffffff817be801>] SyS_writev+0x111/0x2b0 fs/read_write.c:911
 [<ffffffff866531b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 35fa82e449e91fae ]---


On commit 26cd83670f2f5a3d5b5514a1f7d96567cdb9558b