linux-kernel - KASAN: slab-out-of-bounds Write in snd_usb_mixer_notify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00000000000040aa7e05a8c5a02c@google.com>
Date:   Tue, 23 Jun 2020 12:47:14 -0700
From:   syzbot <syzbot+fb14314433463ad51625@...kaller.appspotmail.com>
To:     alsa-devel@...a-project.org, linux-kernel@...r.kernel.org,
        perex@...ex.cz, syzkaller-bugs@...glegroups.com, tiwai@...e.com
Subject: KASAN: slab-out-of-bounds Write in snd_usb_mixer_notify_id

Hello,

syzbot found the following crash on:

HEAD commit:    7ae77150 Merge tag 'powerpc-5.8-1' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a0b46e100000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d195fe572fb15312
dashboard link: https://syzkaller.appspot.com/bug?extid=fb14314433463ad51625
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11bb9d35100000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1309c569100000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fb14314433463ad51625@...kaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240
Write of size 4 at addr ffff888095d78ce0 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240
 snd_usb_mixer_interrupt+0x416/0x980 sound/usb/mixer.c:3379
 __usb_hcd_giveback_urb+0x2af/0x4b0 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
 __skb_queue_head_init include/linux/skbuff.h:1854 [inline]
 skbpoolfree drivers/block/aoe/aoedev.c:435 [inline]
 freedev drivers/block/aoe/aoedev.c:290 [inline]
 dummy_timer+0x1243/0x2fe1 drivers/block/aoe/aoedev.c:366
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches