Re: sound: WARNING in snd_rawmidi_kernel_write1

[Dmitry Vyukov]

On Mon, Feb 1, 2016 at 11:36 AM, Takashi Iwai <tiwai@xxxxxxx> wrote:
> On Mon, 01 Feb 2016 11:15:08 +0100,
> Dmitry Vyukov wrote:
>>
>> Hello,
>>
>> The following program triggers WARNING in snd_rawmidi_kernel_write1:
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <unistd.h>
>> #include <sys/types.h>
>> #include <sys/stat.h>
>> #include <sys/uio.h>
>> #include <fcntl.h>
>>
>> int main()
>> {
>>   int fd;
>>   struct iovec iov;
>>
>>   fd = open("/dev/snd/midiC3D0", O_RDWR);
>
> What is the 3rd device?  Please show /proc/asound/cards content.

Missed this question. Here is it. I run qemu with "-soundhw all" flag.

 0 [Dummy          ]: Dummy - Dummy
                      Dummy 1
 1 [Loopback       ]: Loopback - Loopback
                      Loopback 1
 2 [VirMIDI        ]: VirMIDI - VirMIDI
                      Virtual MIDI Card 1
 3 [port           ]: MTPAV - MTPAV on parallel port
                      MTPAV on parallel port at 0x378
 4 [pcsp           ]: PC-Speaker - pcsp
                      Internal PC-Speaker at port 0x61
 5 [Intel          ]: HDA-Intel - HDA Intel
                      HDA Intel at 0xfebf0000 irq 24

But the patch helps with the warning message :)


>>   iov.iov_base = "";
>>   iov.iov_len = 0;
>>   writev(fd, &iov, 1);
>>   return 0;
>> }
>>
>>
>> ------------[ cut here ]------------
>> WARNING: CPU: 1 PID: 27775 at sound/core/rawmidi.c:1181
>
> The fix is easy, just remove snd_BUG_ON() like below.
>
>
> thanks,
>
> Takashi
>
> ---
> diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
> index a7759846fbaa..f75d1656272c 100644
> --- a/sound/core/rawmidi.c
> +++ b/sound/core/rawmidi.c
> @@ -1178,7 +1178,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
>         long count1, result;
>         struct snd_rawmidi_runtime *runtime = substream->runtime;
>
> -       if (snd_BUG_ON(!kernelbuf && !userbuf))
> +       if (!kernelbuf && !userbuf)
>                 return -EINVAL;
>         if (snd_BUG_ON(!runtime->buffer))
>                 return -EINVAL;
>
>