sound: use-after-free in snd_timer_stop

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I've hit the following use-after-free while running syzkaller fuzzer.
It is followed by a splat of other reports and finally kernel death.
I wasn't able to reproduce it with a standalone C program (there is
probably some global state  involved). But it reproduces by replaying
fuzzer logs in a loop (you will need Go toolchain):

$ go get github.com/google/syzkaller
$ cd $GOPATH/src/github.com/google/syzkaller
$ make executor execprog
$ scp bin/syz-executor bin/syz-execprog your@machine
$ scp snd_timer_stop your@machine # the attached file
on test machine:
$ ./syz-execprog -executor ./syz-executor -cover=0 -repeat=0 -procs=16
snd_timer_stop


==================================================================
BUG: KASAN: use-after-free in _snd_timer_stop+0x394/0x450 at addr
ffff8800356d0b70
Read of size 4 by task syz-executor/6313
=============================================================================
BUG kmalloc-256 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------

INFO: Allocated in snd_timer_instance_new+0x52/0x3a0 age=20 cpu=1 pid=6312
[<      none      >] ___slab_alloc+0x486/0x4e0 mm/slub.c:2468
[<      none      >] __slab_alloc+0x66/0xc0 mm/slub.c:2497
[<     inline     >] slab_alloc_node mm/slub.c:2560
[<     inline     >] slab_alloc mm/slub.c:2602
[<      none      >] kmem_cache_alloc_trace+0x284/0x310 mm/slub.c:2619
[<     inline     >] kmalloc include/linux/slab.h:458
[<     inline     >] kzalloc include/linux/slab.h:602
[<      none      >] snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:105
[<      none      >] snd_timer_open+0x4ff/0xc50 sound/core/timer.c:286
[<      none      >] snd_seq_timer_open+0x223/0x540
sound/core/seq/seq_timer.c:279
[<      none      >] snd_seq_queue_use+0x147/0x230
sound/core/seq/seq_queue.c:526
[<      none      >] snd_seq_queue_alloc+0x36a/0x4d0
sound/core/seq/seq_queue.c:197
[<      none      >] snd_seq_ioctl_create_queue+0xdb/0x2b0
sound/core/seq/seq_clientmgr.c:1536
[<      none      >] snd_seq_do_ioctl+0x19a/0x1c0
sound/core/seq/seq_clientmgr.c:2209
[<      none      >] snd_seq_ioctl+0x5d/0x80 sound/core/seq/seq_clientmgr.c:2224
[<     inline     >] vfs_ioctl fs/ioctl.c:43
[<      none      >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
[<     inline     >] SYSC_ioctl fs/ioctl.c:622
[<      none      >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185

INFO: Freed in snd_timer_close+0x351/0x5e0 age=10 cpu=3 pid=6345
[<      none      >] __slab_free+0x1fc/0x320 mm/slub.c:2678
[<     inline     >] slab_free mm/slub.c:2833
[<      none      >] kfree+0x2a8/0x2d0 mm/slub.c:3662
[<      none      >] snd_timer_close+0x351/0x5e0 sound/core/timer.c:364
[<      none      >] snd_seq_timer_close+0x9e/0x100
sound/core/seq/seq_timer.c:312
[<      none      >] snd_seq_queue_timer_close+0x28/0x50
sound/core/seq/seq_queue.c:473
[<      none      >] snd_seq_ioctl_set_queue_timer+0x159/0x300
sound/core/seq/seq_clientmgr.c:1809
[<      none      >] snd_seq_do_ioctl+0x19a/0x1c0
sound/core/seq/seq_clientmgr.c:2209
[<      none      >] snd_seq_ioctl+0x5d/0x80 sound/core/seq/seq_clientmgr.c:2224
[<     inline     >] vfs_ioctl fs/ioctl.c:43
[<      none      >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
[<     inline     >] SYSC_ioctl fs/ioctl.c:622
[<      none      >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185

INFO: Slab 0xffffea0000d5b400 objects=22 used=8 fp=0xffff8800356d0b60
flags=0x1fffc0000004080
INFO: Object 0xffff8800356d0b60 @offset=2912 fp=0xffff8800356d27d0
CPU: 0 PID: 6313 Comm: syz-executor Tainted: G    B           4.4.0+ #222
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff880036757748 ffffffff82904add ffff88003e807000
 ffff8800356d0b60 ffff8800356d0000 ffff880036757778 ffffffff8172af94
 ffff88003e807000 ffffea0000d5b400 ffff8800356d0b60 ffff8800356d0b60

Call Trace:
 [<ffffffff817344ae>] __asan_report_load4_noabort+0x3e/0x40
mm/kasan/report.c:294
 [<ffffffff84aefda4>] _snd_timer_stop+0x394/0x450 sound/core/timer.c:488
 [<ffffffff84aefe84>] snd_timer_stop+0x24/0x140 sound/core/timer.c:535
 [<ffffffff84b6947e>] snd_seq_timer_close+0x7e/0x100
sound/core/seq/seq_timer.c:311
 [<ffffffff84b6235b>] queue_delete+0x3b/0x90 sound/core/seq/seq_queue.c:146
 [<ffffffff84b63f86>] snd_seq_queue_client_leave+0x36/0x130
sound/core/seq/seq_queue.c:593
 [<ffffffff84b558a8>] seq_free_client1+0x58/0x290
sound/core/seq/seq_clientmgr.c:273
 [<ffffffff84b55b45>] seq_free_client+0x65/0x160
sound/core/seq/seq_clientmgr.c:299
 [<ffffffff84b5882d>] snd_seq_release+0x4d/0xb0
sound/core/seq/seq_clientmgr.c:380
 [<ffffffff8177b453>] __fput+0x233/0x780 fs/file_table.c:208
 [<ffffffff8177ba25>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8139a8fb>] task_work_run+0x16b/0x200 kernel/task_work.c:115
 [<     inline     >] exit_task_work include/linux/task_work.h:21
 [<ffffffff81347b4b>] do_exit+0x8bb/0x2b20 kernel/exit.c:750
 [<ffffffff81349f28>] do_group_exit+0x108/0x320 kernel/exit.c:880
 [<ffffffff8136d124>] get_signal+0x5e4/0x1500 kernel/signal.c:2307
 [<ffffffff81192d83>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712
 [<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210
arch/x86/entry/common.c:247
 [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:282
 [<ffffffff8100851a>] syscall_return_slowpath+0x2ba/0x340
arch/x86/entry/common.c:344
 [<ffffffff85e74a62>] int_ret_from_sys_call+0x25/0x9f
arch/x86/entry/entry_64.S:281
==================================================================

On commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc (Jan 10).

Attachment: snd_timer_stop
Description: Binary data

_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
http://mailman.alsa-project.org/mailman/listinfo/alsa-devel

[Index of Archives]     [ALSA User]     [Linux Audio Users]     [Kernel Archive]     [Asterisk PBX]     [Photo Sharing]     [Linux Sound]     [Video 4 Linux]     [Gimp]     [Yosemite News]

  Powered by Linux