Re: sound: out-of-bounds write in snd_rawmidi_kernel_write1
From: Takashi Iwai
Date: Wed Feb 03 2016 - 04:35:26 EST
On Wed, 03 Feb 2016 09:57:50 +0100,
Dmitry Vyukov wrote:
>
> Hello,
>
> The following program triggers an out-of-bounds write in
> snd_rawmidi_kernel_write1 (run in parallel loop). It seems to try to
> copy -1 bytes (aka 4GB) from user space into kernel smashing all on
> its way.
What card is /dev/midi3? Please check /proc/asound/cards.
Is it MTPAV?
Takashi