syzbot


KASAN: slab-out-of-bounds Write in snd_usb_mixer_notify_id

Status: fixed on 2020/07/17 17:58
Subsystems: usb sound
[Documentation on labels]
Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
Fix commit: 220345e98f1c ALSA: usb-audio: Fix OOB access of mixer element list
First crash: 1403d, last: 1394d
Cause bisection: introduced by (bisect log) [ignored commit]:
commit f2c2e717642c66f7fe7e5dd69b2e8ff5849f4d10
Author: Andrey Konovalov <andreyknvl@google.com>
Date: Mon Feb 24 16:13:03 2020 +0000

  usb: gadget: add raw-gadget interface

Crash: KASAN: slab-out-of-bounds Write in snd_usb_mixer_notify_id (log)
Repro: C syz .config
  
Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: slab-out-of-bounds Read in snd_usb_mixer_interrupt sound 1 1397d 1396d 0/26 closed as dup on 2020/07/07 10:32
Discussions (7)
Title Replies (including bot) Last reply
[PATCH 4.19 000/131] 4.19.131-rc1 review 148 (148) 2020/07/05 13:30
[PATCH 5.7 000/265] 5.7.7-rc1 review 280 (280) 2020/07/01 15:34
[PATCH 4.9 000/191] 4.9.229-rc1 review 199 (199) 2020/07/01 06:45
[PATCH 5.4 000/178] 5.4.50-rc1 review 182 (182) 2020/06/30 17:22
[PATCH 4.14 00/78] 4.14.186-rc1 review 83 (83) 2020/06/30 17:21
[PATCH 4.4 000/135] 4.4.229-rc1 review 140 (140) 2020/06/30 17:20
KASAN: slab-out-of-bounds Write in snd_usb_mixer_notify_id 0 (1) 2020/06/23 19:47

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240
Write of size 4 at addr ffff888095d78ce0 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 snd_usb_mixer_notify_id+0x219/0x2a0 sound/usb/mixer.c:3240
 snd_usb_mixer_interrupt+0x416/0x980 sound/usb/mixer.c:3379
 __usb_hcd_giveback_urb+0x2af/0x4b0 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
 __skb_queue_head_init include/linux/skbuff.h:1854 [inline]
 skbpoolfree drivers/block/aoe/aoedev.c:435 [inline]
 freedev drivers/block/aoe/aoedev.c:290 [inline]
 dummy_timer+0x1243/0x2fe1 drivers/block/aoe/aoedev.c:366
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786

Crashes (39):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/20 00:59 upstream 7ae77150d94d 81abc331 .config console log report syz C ci-upstream-kasan-gce-root
2020/06/19 23:10 upstream 7ae77150d94d 81abc331 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/06/19 22:15 upstream 7ae77150d94d 81abc331 .config console log report syz C ci-upstream-kasan-gce
2020/06/19 21:46 upstream 7ae77150d94d 81abc331 .config console log report syz C ci-upstream-kasan-gce-386
2020/06/19 22:08 linux-next e7b08814b16b 81abc331 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/06/19 19:39 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing f8f02d5c671f 123cf502 .config console log report syz C ci2-upstream-usb
2020/06/25 10:48 upstream 7ae77150d94d 54566aff .config console log report ci-upstream-kasan-gce
2020/06/25 01:58 upstream 7ae77150d94d 54566aff .config console log report ci-upstream-kasan-gce-root
2020/06/24 23:12 upstream 7ae77150d94d 54566aff .config console log report ci-upstream-kasan-gce
2020/06/24 00:09 upstream 7ae77150d94d 54566aff .config console log report ci-upstream-kasan-gce-root
2020/06/23 23:53 upstream 7ae77150d94d 54566aff .config console log report ci-upstream-kasan-gce
2020/06/28 21:20 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/28 19:55 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/28 14:05 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/28 03:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 23:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 23:09 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 23:06 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 17:15 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 16:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report ci2-upstream-usb
2020/06/27 15:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 2defc703 .config console log report ci2-upstream-usb
2020/06/27 07:57 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c ffec44b5 .config console log report ci2-upstream-usb
2020/06/27 06:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c ffec44b5 .config console log report ci2-upstream-usb
2020/06/26 21:54 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 349959fb .config console log report ci2-upstream-usb
2020/06/26 20:22 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 349959fb .config console log report ci2-upstream-usb
2020/06/26 16:55 linux-next e7b08814b16b aea82c00 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/06/26 16:51 linux-next e7b08814b16b aea82c00 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/06/26 16:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9506ea6d .config console log report ci2-upstream-usb
2020/06/26 16:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9506ea6d .config console log report ci2-upstream-usb
2020/06/26 02:30 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c aea82c00 .config console log report ci2-upstream-usb
2020/06/26 01:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c aea82c00 .config console log report ci2-upstream-usb
2020/06/25 15:15 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c c7b4497a .config console log report ci2-upstream-usb
2020/06/25 14:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c c7b4497a .config console log report ci2-upstream-usb
2020/06/25 05:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9d60b18e .config console log report ci2-upstream-usb
2020/06/25 03:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9d60b18e .config console log report ci2-upstream-usb
2020/06/24 23:04 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9d60b18e .config console log report ci2-upstream-usb
2020/06/24 07:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing f8f02d5c671f bbad15ae .config console log report ci2-upstream-usb
2020/06/24 06:57 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing f8f02d5c671f bbad15ae .config console log report ci2-upstream-usb
2020/06/23 21:34 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing f8f02d5c671f 6930bbef .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.