syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in snd_pcm_oss_release

Status: fixed on 2020/10/02 13:00
Reported-by: syzbot+2e14b29255294d1caa46@syzkaller.appspotmail.com
Fix commit: 37d933e8b41b fix regression in "epoll: Keep a reference on files added to the check list"
First crash: 1325d, last: 1325d
Fix bisection: fixed by (bisect log) :
commit 37d933e8b41b83bb8278815e366aec5a542b7e31
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed Sep 2 15:30:48 2020 +0000

  fix regression in "epoll: Keep a reference on files added to the check list"

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in snd_pcm_oss_release syz done 1 1325d 1325d 1/1 fixed on 2020/10/03 03:40
upstream KASAN: use-after-free Read in snd_pcm_oss_release sound 1 1331d 1330d 15/26 fixed on 2020/09/25 01:17

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in snd_pcm_oss_release+0x283/0x300 sound/core/oss/pcm_oss.c:2554
Read of size 8 at addr ffff8880996de980 by task syz-executor.0/11633

CPU: 1 PID: 11633 Comm: syz-executor.0 Not tainted 4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 snd_pcm_oss_release+0x283/0x300 sound/core/oss/pcm_oss.c:2554
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x416f01
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdc3ed2680 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000416f01
RDX: 0000000000000000 RSI: 00000000011904b0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffdc3ed2770 R11: 0000000000000293 R12: 00000000011904b0
R13: 0000000000017299 R14: ffffffffffffffff R15: 000000000118cfec

Allocated by task 11641:
 kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2403 [inline]
 snd_pcm_oss_open.part.0+0x53e/0x12a0 sound/core/oss/pcm_oss.c:2506
 snd_pcm_oss_open+0x3c/0x50 sound/core/oss/pcm_oss.c:2470
 soundcore_open+0x445/0x600 sound/sound_core.c:598
 chrdev_open+0x266/0x770 fs/char_dev.c:423
 do_dentry_open+0x4aa/0x1160 fs/open.c:796
 do_last fs/namei.c:3421 [inline]
 path_openat+0x793/0x2df0 fs/namei.c:3537
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_sys_open+0x3b3/0x520 fs/open.c:1085
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 11641:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2385 [inline]
 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2375 [inline]
 snd_pcm_oss_release+0x17e/0x300 sound/core/oss/pcm_oss.c:2563
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880996de980
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 32-byte region [ffff8880996de980, ffff8880996de9a0)
The buggy address belongs to the page:
page:ffffea000265b780 count:1 mapcount:0 mapping:ffff88812c39c1c0 index:0xffff8880996defc1
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea00023f1848 ffffea000265ce48 ffff88812c39c1c0
raw: ffff8880996defc1 ffff8880996de000 000000010000003f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880996de880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880996de900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>ffff8880996de980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                   ^
 ffff8880996dea00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880996dea80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/02 04:26 linux-4.19.y f6d5cb9e2c06 abf9ba4f .config console log report syz ci2-linux-4-19
* Struck through repros no longer work on HEAD.