syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12490] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: null-ptr-deref Write in submit_audio_out_urb

Status: fixed on 2019/06/18 17:49
Subsystems: sound usb
[Documentation on labels]
Reported-by: syzbot+5255458d5e0a2b10bbb9@syzkaller.appspotmail.com
Fix commit: 0b074ab7fc0d ALSA: line6: Assure canceling delayed work at disconnection
First crash: 1792d, last: 1777d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 5.1 00/85] 5.1.8-stable review 103 (103) 2019/06/11 08:50
[PATCH 4.19 00/73] 4.19.49-stable review 77 (77) 2019/06/08 18:49
KASAN: null-ptr-deref Write in submit_audio_out_urb 0 (1) 2019/05/27 15:28
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in submit_audio_out_urb (2) usb C 3423 1729d 1761d 12/26 fixed on 2019/07/29 13:39

Sample crash report:
snd_usb_toneport 1-1:9.108: read request failed (error -110)
snd_usb_toneport 1-1:9.108: read request failed (error -110)
snd_usb_toneport 1-1:9.108: write request failed (error -110)
usb 1-1: send failed (error -110)
usb 1-1: send failed (error -110)
snd_usb_toneport 1-1:9.108: Line 6 POD Studio UX1 now attached
==================================================================
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:344 [inline]
BUG: KASAN: null-ptr-deref in submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246
Write of size 20 at addr 0000000000000010 by task kworker/1:0/17

CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.2.0-rc1+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events toneport_start_pcm
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 __kasan_report.cold+0x5/0x32 mm/kasan/report.c:321
 kasan_report+0xe/0x20 mm/kasan/common.c:614
 memset+0x20/0x40 mm/kasan/common.c:107
 memset include/linux/string.h:344 [inline]
 submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246
 line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:295
 line6_stream_start+0x156/0x1f0 sound/usb/line6/pcm.c:199
 line6_pcm_acquire+0x134/0x210 sound/usb/line6/pcm.c:322
 process_one_work+0x905/0x1570 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x30b/0x410 kernel/kthread.c:254
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 17 Comm: kworker/1:0 Tainted: G    B             5.2.0-rc1+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events toneport_start_pcm
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 panic+0x292/0x6c9 kernel/panic.c:218
 end_report+0x43/0x49 mm/kasan/report.c:95
 __kasan_report.cold+0xd/0x32 mm/kasan/report.c:324
 kasan_report+0xe/0x20 mm/kasan/common.c:614
 memset+0x20/0x40 mm/kasan/common.c:107
 memset include/linux/string.h:344 [inline]
 submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246
 line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:295
 line6_stream_start+0x156/0x1f0 sound/usb/line6/pcm.c:199
 line6_pcm_acquire+0x134/0x210 sound/usb/line6/pcm.c:322
 process_one_work+0x905/0x1570 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x30b/0x410 kernel/kthread.c:254
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (185):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/11 21:22 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 5b5826d0 .config console log report syz C ci2-upstream-usb
2019/05/27 14:33 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 562efd79 .config console log report syz C ci2-upstream-usb
2019/06/07 09:38 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 698773cb .config console log report ci2-upstream-usb
2019/06/07 08:14 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 698773cb .config console log report ci2-upstream-usb
2019/06/07 04:34 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 698773cb .config console log report ci2-upstream-usb
2019/06/07 01:03 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 22:04 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 20:57 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 17:30 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 16:20 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 15:00 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f f5dd5568 .config console log report ci2-upstream-usb
2019/06/06 13:28 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a547defc .config console log report ci2-upstream-usb
2019/06/06 10:24 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a547defc .config console log report ci2-upstream-usb
2019/06/06 08:39 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a547defc .config console log report ci2-upstream-usb
2019/06/06 05:38 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a547defc .config console log report ci2-upstream-usb
2019/06/05 18:53 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f bfb4a51e .config console log report ci2-upstream-usb
2019/06/05 16:09 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f bfb4a51e .config console log report ci2-upstream-usb
2019/06/05 11:43 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f bfb4a51e .config console log report ci2-upstream-usb
2019/06/05 08:33 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f bfb4a51e .config console log report ci2-upstream-usb
2019/06/04 13:40 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f e41a20c5 .config console log report ci2-upstream-usb
2019/06/04 07:51 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f ce07a7ae .config console log report ci2-upstream-usb
2019/06/04 04:02 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f ce07a7ae .config console log report ci2-upstream-usb
2019/06/04 02:02 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f ce07a7ae .config console log report ci2-upstream-usb
2019/06/03 15:52 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 63bf051f .config console log report ci2-upstream-usb
2019/06/03 10:21 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/03 08:58 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/03 06:50 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/03 03:12 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 11:38 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 10:11 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 06:25 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 05:18 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/02 04:12 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 21:50 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 19:06 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 17:12 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 12:40 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 09:59 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 06:34 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 05:20 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/06/01 03:39 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report ci2-upstream-usb
2019/05/31 21:10 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a8482b78 .config console log report ci2-upstream-usb
2019/05/31 18:34 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a8482b78 .config console log report ci2-upstream-usb
2019/05/31 16:36 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a8482b78 .config console log report ci2-upstream-usb
2019/05/31 15:07 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a8482b78 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.