syzbot

==================================================================
BUG: KASAN: slab-out-of-bounds in resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160
Read of size 2 at addr ffff8880a540ff00 by task syz-executor756/7483

CPU: 1 PID: 7483 Comm: syz-executor756 Not tainted 4.14.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x13e/0x194 lib/dump_stack.c:58
 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393
 resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160
 rate_transfer sound/core/oss/rate.c:279 [inline]
 rate_transfer+0x1b2/0x250 sound/core/oss/rate.c:249
 snd_pcm_plug_read_transfer+0x14f/0x250 sound/core/oss/pcm_plugin.c:650
 snd_pcm_oss_read2+0x1ac/0x340 sound/core/oss/pcm_oss.c:1475
 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1532 [inline]
 snd_pcm_oss_read+0x486/0x5e0 sound/core/oss/pcm_oss.c:2753
 do_loop_readv_writev fs/read_write.c:695 [inline]
 do_loop_readv_writev fs/read_write.c:682 [inline]
 do_iter_read+0x3e3/0x5a0 fs/read_write.c:919
 vfs_readv+0xd3/0x130 fs/read_write.c:981
 do_readv+0xfc/0x2c0 fs/read_write.c:1014
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446c59
RSP: 002b:00007f2fcf884db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000446c59
RDX: 0000000000000001 RSI: 0000000020395000 RDI: 0000000000000003
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c
R13: 00007fff729b479f R14: 00007f2fcf8859c0 R15: 20c49ba5e353f7cf

Allocated by task 7483:
 save_stack+0x32/0xa0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc mm/kasan/kasan.c:551 [inline]
 kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529
 __do_kmalloc_node mm/slab.c:3682 [inline]
 __kmalloc_node+0x4c/0x70 mm/slab.c:3689
 kmalloc_node include/linux/slab.h:530 [inline]
 kvmalloc_node+0x46/0xd0 mm/util.c:397
 kvmalloc include/linux/mm.h:531 [inline]
 kvzalloc include/linux/mm.h:539 [inline]
 snd_pcm_plugin_alloc+0x4cf/0x700 sound/core/oss/pcm_plugin.c:70
 snd_pcm_plug_alloc+0x13e/0x300 sound/core/oss/pcm_plugin.c:129
 snd_pcm_oss_change_params_locked+0x1c0d/0x30a0 sound/core/oss/pcm_oss.c:1039
 snd_pcm_oss_change_params+0x5e/0xb0 sound/core/oss/pcm_oss.c:1102
 snd_pcm_oss_get_active_substream+0xf5/0x140 sound/core/oss/pcm_oss.c:1119
 snd_pcm_oss_get_rate sound/core/oss/pcm_oss.c:1769 [inline]
 snd_pcm_oss_set_rate sound/core/oss/pcm_oss.c:1761 [inline]
 snd_pcm_oss_ioctl+0xbe7/0x2b00 sound/core/oss/pcm_oss.c:2609
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 3716:
 save_stack+0x32/0xa0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kfree+0xcb/0x260 mm/slab.c:3815
 skb_free_head+0x83/0xa0 net/core/skbuff.c:554
 skb_release_data+0x528/0x7b0 net/core/skbuff.c:574
 skb_release_all+0x46/0x60 net/core/skbuff.c:631
 __kfree_skb net/core/skbuff.c:645 [inline]
 consume_skb+0xa7/0x330 net/core/skbuff.c:705
 skb_free_datagram+0x16/0xe0 net/core/datagram.c:331
 unix_dgram_recvmsg+0x70a/0xcd0 net/unix/af_unix.c:2207
 sock_recvmsg_nosec net/socket.c:819 [inline]
 sock_recvmsg net/socket.c:826 [inline]
 sock_recvmsg+0xc0/0x100 net/socket.c:822
 SYSC_recvfrom+0x18c/0x290 net/socket.c:1815
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8880a540fd00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes to the right of
 512-byte region [ffff8880a540fd00, ffff8880a540ff00)
The buggy address belongs to the page:
page:ffffea00029503c0 count:1 mapcount:0 mapping:ffff8880a540f080 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff8880a540f080 0000000000000000 0000000100000006
raw: ffffea00029e12a0 ffffea0002245560 ffff88812fe56940 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a540fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880a540fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880a540ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8880a540ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a5410000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================