On Fri, Jul 22, 2022 at 09:37:52AM -0700, Dipanjan Das wrote: > Hi, > > We would like to report the following bug which has been found by our > modified version of syzkaller. > > ====================================================== > description: KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params > affected file: sound/core/pcm_native.c > kernel version: 5.10.131 > kernel commit: de62055f423f5dcb548f74cebd68f03c8903f73a > git tree: upstream > kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9 > crash reproducer: attached > ====================================================== > Crash log: > ====================================================== > BUG: KASAN: vmalloc-out-of-bounds in memset include/linux/string.h:384 [inline] > BUG: KASAN: vmalloc-out-of-bounds in snd_pcm_hw_params+0x19b0/0x1db0 > sound/core/pcm_native.c:799 > Write of size 2097152 at addr ffffc900113b2000 by task syz-executor.5/14437 > > CPU: 1 PID: 14437 Comm: syz-executor.5 Tainted: G OE 5.10.131+ #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > 1.13.0-1ubuntu1.1 04/01/2014 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x107/0x163 lib/dump_stack.c:118 > print_address_description.constprop.0.cold+0x5/0x4f7 mm/kasan/report.c:385 > __kasan_report mm/kasan/report.c:545 [inline] > kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 > check_memory_region_inline mm/kasan/generic.c:194 [inline] > check_memory_region+0x187/0x1e0 mm/kasan/generic.c:200 > memset+0x20/0x40 mm/kasan/common.c:85 > memset include/linux/string.h:384 [inline] > snd_pcm_hw_params+0x19b0/0x1db0 sound/core/pcm_native.c:799 > snd_pcm_kernel_ioctl+0xd1/0x240 sound/core/pcm_native.c:3401 > snd_pcm_oss_change_params_locked+0x17b6/0x3aa0 sound/core/oss/pcm_oss.c:965 > snd_pcm_oss_change_params+0x76/0xd0 sound/core/oss/pcm_oss.c:1107 > snd_pcm_oss_make_ready+0xb7/0x170 sound/core/oss/pcm_oss.c:1166 > snd_pcm_oss_set_trigger.isra.0+0x34f/0x770 sound/core/oss/pcm_oss.c:2074 > snd_pcm_oss_poll+0x679/0xb40 sound/core/oss/pcm_oss.c:2858 > vfs_poll include/linux/poll.h:90 [inline] > do_pollfd fs/select.c:872 [inline] > do_poll fs/select.c:920 [inline] > do_sys_poll+0x63c/0xe40 fs/select.c:1014 > __do_sys_poll fs/select.c:1079 [inline] > __se_sys_poll fs/select.c:1067 [inline] > __x64_sys_poll+0x18c/0x490 fs/select.c:1067 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > RIP: 0033:0x7f095de4f4ed > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007f095bdffbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 > RAX: ffffffffffffffda RBX: 00007f095df6df60 RCX: 00007f095de4f4ed > RDX: 0000000000000009 RSI: 0000000000000001 RDI: 00000000200000c0 > RBP: 00007f095bdffc40 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001d > R13: 00007ffff286ceff R14: 00007f095df6df60 R15: 00007f095bdffd80 > > > Memory state around the buggy address: > ffffc900115b1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffffc900115b1d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >ffffc900115b1e00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > ^ > ffffc900115b1e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > ffffc900115b1f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > ================================================================== Wondeful, do you have a fix for this that solves the reported problem that you have tested with the reproducer? thanks, greg k-h
