syzbot


general protection fault in snd_rawmidi_ioctl_compat

Status: fixed on 2018/05/08 18:30
Subsystems: sound
[Documentation on labels]
Reported-by: syzbot+f7a0348affc3b67bc617@syzkaller.appspotmail.com
Fix commit: 8a56ef4f3ffb ALSA: rawmidi: Fix missing input substream checks in compat ioctls
First crash: 2199d, last: 2199d
Discussions (7)
Title Replies (including bot) Last reply
[PATCH 3.16 000/366] 3.16.60-rc1 review 370 (370) 2019/03/29 15:47
[PATCH 4.4 00/97] 4.4.129-stable review 111 (111) 2018/05/17 08:54
[PATCH 4.16 000/196] 4.16.4-stable review 213 (213) 2018/04/28 14:59
[PATCH 4.9 00/95] 4.9.96-stable review 120 (120) 2018/04/26 06:46
[PATCH 4.14 000/164] 4.14.36-stable review 172 (172) 2018/04/24 07:25
[PATCH 3.18 00/52] 3.18.106-stable review 61 (61) 2018/04/23 21:39
general protection fault in snd_rawmidi_ioctl_compat 1 (2) 2018/04/19 16:20

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 21671 Comm: syz-executor7 Not tainted 4.16.0+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:snd_rawmidi_ioctl_status_x32 sound/core/rawmidi_compat.c:125 [inline]
RIP: 0010:snd_rawmidi_ioctl_compat+0x51d/0xba0 sound/core/rawmidi_compat.c:168
RSP: 0018:ffff88018ccdfc08 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900054cb000
RDX: 000000000000000b RSI: ffffffff85a61885 RDI: 0000000000000058
RBP: ffff88018ccdfd80 R08: ffff8801af6f0740 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000000 R12: 1ffff1003199bf83
R13: 0000000000930000 R14: ffff88018ccdfcf8 R15: 0000000000000001
FS:  00007fa64d466700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa30835b518 CR3: 00000001879ef000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 C_SYSC_ioctl fs/compat_ioctl.c:1461 [inline]
 compat_SyS_ioctl+0xa37/0x33b0 fs/compat_ioctl.c:1407
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x455259
RSP: 002b:00007fa64d465c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000202
RAX: ffffffffffffffda RBX: 00007fa64d4666d4 RCX: 0000000000455259
RDX: 0000000000930000 RSI: 00000000c0305720 RDI: 0000000000000013
RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000641 R14: 00000000006fc6b8 R15: 0000000000000001
Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 1c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d 7b 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e5 05 00 00 48 8b 7b 58 4c 89 f6 e8 5d cc ff 
RIP: snd_rawmidi_ioctl_status_x32 sound/core/rawmidi_compat.c:125 [inline] RSP: ffff88018ccdfc08
RIP: snd_rawmidi_ioctl_compat+0x51d/0xba0 sound/core/rawmidi_compat.c:168 RSP: ffff88018ccdfc08
---[ end trace 7dcd43c411f49842 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/11 14:43 upstream b284d4d5a678 8b8de427 .config console log report ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.