syzbot

 sign-in | mailing list | source | docs
🐞 Open [980] ≡ Subsystems 🐞 Fixed [5208] 🐞 Invalid [12468] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: null-ptr-deref Write in submit_audio_out_urb (2)

Status: fixed on 2019/07/29 13:39
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+219f00fb49874dcaea17@syzkaller.appspotmail.com
Fix commit: 3450121997ce ALSA: line6: Fix write on zero-sized buffer
First crash: 1756d, last: 1724d
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[PATCH 4.4 00/76] 4.4.211-stable review 81 (81) 2020/01/22 20:52
[PATCH 3.16 000/132] 3.16.74-rc1 review 141 (141) 2019/11/19 20:40
[PATCH 5.1 00/96] 5.1.17-stable review 115 (115) 2019/07/15 20:07
[PATCH 4.19 00/90] 4.19.58-stable review 99 (99) 2019/07/10 06:13
[PATCH 4.14 00/56] 4.14.133-stable review 64 (64) 2019/07/10 06:12
[PATCH 4.9 000/102] 4.9.185-stable review 108 (108) 2019/07/10 06:11
KASAN: null-ptr-deref Write in submit_audio_out_urb (2) 0 (1) 2019/06/27 16:47
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in submit_audio_out_urb sound usb C 185 1772d 1787d 12/26 fixed on 2019/06/18 17:49

Sample crash report:
snd_usb_toneport 1-1:0.49: write request failed (error -32)
usb 1-1: send failed (error -32)
usb 1-1: send failed (error -32)
snd_usb_toneport 1-1:0.49: Line 6 POD Studio UX1 now attached
==================================================================
BUG: KASAN: null-ptr-deref in memset /./include/linux/string.h:344 [inline]
BUG: KASAN: null-ptr-deref in submit_audio_out_urb+0x919/0x1780 /sound/usb/line6/playback.c:242
Write of size 20 at addr 0000000000000010 by task kworker/0:1/12

CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc6+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events line6_startup_work
Call Trace:
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e /lib/dump_stack.c:113
 __kasan_report.cold+0x5/0x32 /mm/kasan/report.c:321
 kasan_report+0xe/0x20 /mm/kasan/common.c:614
 memset+0x20/0x40 /mm/kasan/common.c:107
 memset /./include/linux/string.h:344 [inline]
 submit_audio_out_urb+0x919/0x1780 /sound/usb/line6/playback.c:242
 line6_submit_audio_out_all_urbs+0xc9/0x120 /sound/usb/line6/playback.c:291
 line6_stream_start+0x156/0x1f0 /sound/usb/line6/pcm.c:195
 line6_pcm_acquire+0x134/0x210 /sound/usb/line6/pcm.c:318
 line6_startup_work+0x42/0x50 /sound/usb/line6/driver.c:725
 process_one_work+0x905/0x1570 /kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 /kernel/workqueue.c:2415
 kthread+0x30b/0x410 /kernel/kthread.c:255
 ret_from_fork+0x24/0x30 /arch/x86/entry/entry_64.S:352
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G    B             5.2.0-rc6+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events line6_startup_work
Call Trace:
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e /lib/dump_stack.c:113
 panic+0x292/0x6c9 /kernel/panic.c:219
 end_report+0x43/0x49 /mm/kasan/report.c:95
 __kasan_report.cold+0xd/0x32 /mm/kasan/report.c:324
 kasan_report+0xe/0x20 /mm/kasan/common.c:614
 memset+0x20/0x40 /mm/kasan/common.c:107
 memset /./include/linux/string.h:344 [inline]
 submit_audio_out_urb+0x919/0x1780 /sound/usb/line6/playback.c:242
 line6_submit_audio_out_all_urbs+0xc9/0x120 /sound/usb/line6/playback.c:291
 line6_stream_start+0x156/0x1f0 /sound/usb/line6/pcm.c:195
 line6_pcm_acquire+0x134/0x210 /sound/usb/line6/pcm.c:318
 line6_startup_work+0x42/0x50 /sound/usb/line6/driver.c:725
 process_one_work+0x905/0x1570 /kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 /kernel/workqueue.c:2415
 kthread+0x30b/0x410 /kernel/kthread.c:255
 ret_from_fork+0x24/0x30 /arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (3423):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/20 17:11 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config console log report syz C ci2-upstream-usb
2019/07/11 18:45 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 186a30b9 .config console log report syz C ci2-upstream-usb
2019/07/09 21:46 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report syz C ci2-upstream-usb
2019/07/01 20:56 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 907bf746 .config console log report syz C ci2-upstream-usb
2019/06/28 21:20 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 7509bf36 .config console log report syz C ci2-upstream-usb
2019/06/27 16:41 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 7509bf36 .config console log report syz C ci2-upstream-usb
2019/07/29 13:17 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 12:30 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 11:29 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 10:38 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 09:35 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 09:11 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 08:02 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 07:27 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 06:21 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 05:35 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 04:34 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 04:06 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 03:04 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 02:42 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 01:41 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 01:22 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/29 00:09 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 23:48 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 22:46 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 22:13 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 21:12 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 20:17 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 19:15 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 18:29 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 17:20 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 17:05 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 15:58 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 15:02 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 13:58 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 13:42 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 12:39 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 12:27 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 11:23 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 11:22 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 10:15 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 09:12 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 08:49 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 07:49 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 07:01 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 05:46 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/07/28 04:45 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config console log report ci2-upstream-usb
2019/06/27 15:23 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 7509bf36 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.