syzbot


BUG: unable to handle kernel paging request in snd_pcm_format_set_silence

Status: fixed on 2018/05/08 18:30
Subsystems: sound
[Documentation on labels]
Reported-by: syzbot+f973e52978d95f818f69@syzkaller.appspotmail.com
Fix commit: 02a5d6925cd3 ALSA: pcm: Avoid potential races between OSS ioctls and read/write
First crash: 2421d, last: 2350d
Discussions (1)
Title Replies (including bot) Last reply
BUG: unable to handle kernel paging request in snd_pcm_format_set_silence 0 (1) 2018/04/11 18:44

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel paging request at ffffc90004cc7000
PGD 1dad42067 P4D 1dad42067 PUD 1dad43067 PMD 1c5cb3067 PTE 0
Oops: 0002 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 5516 Comm: syz-executor3 Not tainted 4.16.0+ #288
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:65
RSP: 0018:ffff8801d7fc7368 EFLAGS: 00010246
RAX: fffff520009b9600 RBX: ffffc90004cc7000 RCX: 0000000000104500
RDX: 0000000000104500 RSI: 0000000000000000 RDI: ffffc90004cc7000
RBP: ffff8801d7fc7388 R08: 0000000000000000 R09: ffffc90004cc7000
R10: 00000000000208a0 R11: fffff520009b969f R12: 0000000000104500
R13: 0000000000000000 R14: ffffffff88c9185c R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff8801db000000(0063) knlGS:00000000f7f5fb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffc90004cc7000 CR3: 00000001d765c000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memset include/linux/string.h:330 [inline]
 snd_pcm_format_set_silence+0x13f/0x4b0 sound/core/pcm_misc.c:431
 loopback_prepare+0x92b/0xbf0 sound/drivers/aloop.c:347
 snd_pcm_do_prepare+0x58/0x90 sound/core/pcm_native.c:1640
 snd_pcm_action_single+0x70/0x110 sound/core/pcm_native.c:1084
 snd_pcm_action_nonatomic+0x95/0xa0 sound/core/pcm_native.c:1151
 snd_pcm_prepare+0x115/0x1a0 sound/core/pcm_native.c:1687
 snd_pcm_kernel_ioctl+0x97/0x240 sound/core/pcm_native.c:2998
 snd_pcm_oss_prepare+0x49/0x150 sound/core/oss/pcm_oss.c:1104
 snd_pcm_oss_make_ready+0xf9/0x130 sound/core/oss/pcm_oss.c:1132
 snd_pcm_oss_set_trigger+0x384/0x930 sound/core/oss/pcm_oss.c:1959
 snd_pcm_oss_poll+0x7aa/0xd60 sound/core/oss/pcm_oss.c:2727
 do_pollfd fs/select.c:832 [inline]
 do_poll fs/select.c:883 [inline]
 do_sys_poll+0x719/0x1050 fs/select.c:977
 SYSC_poll fs/select.c:1035 [inline]
 SyS_poll+0x10d/0x450 fs/select.c:1023
 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f63c99
RSP: 002b:00000000f7f5f0ac EFLAGS: 00000282 ORIG_RAX: 00000000000000a8
RAX: ffffffffffffffda RBX: 0000000020000100 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 
RIP: memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:65 RSP: ffff8801d7fc7368
CR2: ffffc90004cc7000
---[ end trace 95a476f9da224f32 ]---

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/10 20:29 upstream f2d285669aae 8b8de427 .config console log report syz ci-upstream-kasan-gce-386
2018/02/26 06:58 upstream c89be5242607 9fe8aa42 .config console log report ci-upstream-kasan-gce
2018/05/08 10:46 https://github.com/google/kmsan.git master d2d741e5d189 045bbd4a .config console log report ci-upstream-kmsan-gce
2018/05/08 00:53 https://github.com/google/kmsan.git master d2d741e5d189 9e0846e8 .config console log report ci-upstream-kmsan-gce
2018/05/07 10:08 https://github.com/google/kmsan.git master d2d741e5d189 a211da1a .config console log report ci-upstream-kmsan-gce
2018/05/06 20:28 https://github.com/google/kmsan.git master d2d741e5d189 6c18ddb0 .config console log report ci-upstream-kmsan-gce
2018/05/05 22:47 https://github.com/google/kmsan.git master d2d741e5d189 78b251cb .config console log report ci-upstream-kmsan-gce
2018/05/03 23:22 https://github.com/google/kmsan.git master d2d741e5d189 9ce14f4b .config console log report ci-upstream-kmsan-gce
2018/04/29 03:48 https://github.com/google/kmsan.git master d2d741e5d189 d5a5d045 .config console log report ci-upstream-kmsan-gce
2018/04/28 08:01 https://github.com/google/kmsan.git master d2d741e5d189 d5a5d045 .config console log report ci-upstream-kmsan-gce
2018/04/25 21:21 https://github.com/google/kmsan.git master d2d741e5d189 73417389 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.