linux-kernel - Re: KASAN: use-after-free Read in snd_pcm_oss_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <s5hpo4bh99i.wl-tiwai@suse.de>
Date:   Sat, 10 Mar 2018 23:10:33 +0100
From:   Takashi Iwai <tiwai@...e.de>
To:     syzbot <syzbot+4090700a4f13fccaf648@...kaller.appspotmail.com>
Cc:     <alsa-devel@...a-project.org>, <syzkaller-bugs@...glegroups.com>,
        <mingo@...nel.org>, <perex@...ex.cz>, <o-takashi@...amocchi.jp>,
        <linux-kernel@...r.kernel.org>, <viro@...iv.linux.org.uk>
Subject: Re: KASAN: use-after-free Read in snd_pcm_oss_get_formats

On Fri, 09 Mar 2018 21:59:03 +0100,
syzbot wrote:
> 
> Hello,
> 
> syzbot hit the following crash on upstream commit
> 1b88accf6a659c46d5c8e68912896f112bf882bb (Thu Mar 8 01:49:33 2018 +0000)
> Merge tag 'for_linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
> 
> So far this crash happened 3 times on upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+4090700a4f13fccaf648@...kaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
> 
> IPVS: ftp: loaded support on port[0] = 21
> audit: type=1400 audit(1520612143.836:8): avc:  denied  { map } for
> pid=4259 comm="syzkaller191035" path="/dev/dsp1" dev="devtmpfs"
> ino=1250  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file
> permissive=1
> IPVS: ftp: loaded support on port[0] = 21
> IPVS: ftp: loaded support on port[0] = 21
> ==================================================================
> BUG: KASAN: use-after-free in snd_mask_test
> include/sound/pcm_params.h:141  [inline]
> BUG: KASAN: use-after-free in snd_pcm_oss_get_formats+0x320/0x380
> sound/core/oss/pcm_oss.c:1770

Doh, this is a so-clear UAF, shining brightly in the code.
Will submit / merge the fix patch.


thanks,

Takashi