================================================================== BUG: KASAN: slab-out-of-bounds in resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160 Read of size 2 at addr ffff8880a540ff00 by task syz-executor756/7483 CPU: 1 PID: 7483 Comm: syz-executor756 Not tainted 4.14.173-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160 rate_transfer sound/core/oss/rate.c:279 [inline] rate_transfer+0x1b2/0x250 sound/core/oss/rate.c:249 snd_pcm_plug_read_transfer+0x14f/0x250 sound/core/oss/pcm_plugin.c:650 snd_pcm_oss_read2+0x1ac/0x340 sound/core/oss/pcm_oss.c:1475 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1532 [inline] snd_pcm_oss_read+0x486/0x5e0 sound/core/oss/pcm_oss.c:2753 do_loop_readv_writev fs/read_write.c:695 [inline] do_loop_readv_writev fs/read_write.c:682 [inline] do_iter_read+0x3e3/0x5a0 fs/read_write.c:919 vfs_readv+0xd3/0x130 fs/read_write.c:981 do_readv+0xfc/0x2c0 fs/read_write.c:1014 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x446c59 RSP: 002b:00007f2fcf884db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000446c59 RDX: 0000000000000001 RSI: 0000000020395000 RDI: 0000000000000003 RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c R13: 00007fff729b479f R14: 00007f2fcf8859c0 R15: 20c49ba5e353f7cf Allocated by task 7483: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node+0x4c/0x70 mm/slab.c:3689 kmalloc_node include/linux/slab.h:530 [inline] kvmalloc_node+0x46/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:531 [inline] kvzalloc include/linux/mm.h:539 [inline] snd_pcm_plugin_alloc+0x4cf/0x700 sound/core/oss/pcm_plugin.c:70 snd_pcm_plug_alloc+0x13e/0x300 sound/core/oss/pcm_plugin.c:129 snd_pcm_oss_change_params_locked+0x1c0d/0x30a0 sound/core/oss/pcm_oss.c:1039 snd_pcm_oss_change_params+0x5e/0xb0 sound/core/oss/pcm_oss.c:1102 snd_pcm_oss_get_active_substream+0xf5/0x140 sound/core/oss/pcm_oss.c:1119 snd_pcm_oss_get_rate sound/core/oss/pcm_oss.c:1769 [inline] snd_pcm_oss_set_rate sound/core/oss/pcm_oss.c:1761 [inline] snd_pcm_oss_ioctl+0xbe7/0x2b00 sound/core/oss/pcm_oss.c:2609 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 3716: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 skb_free_head+0x83/0xa0 net/core/skbuff.c:554 skb_release_data+0x528/0x7b0 net/core/skbuff.c:574 skb_release_all+0x46/0x60 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] consume_skb+0xa7/0x330 net/core/skbuff.c:705 skb_free_datagram+0x16/0xe0 net/core/datagram.c:331 unix_dgram_recvmsg+0x70a/0xcd0 net/unix/af_unix.c:2207 sock_recvmsg_nosec net/socket.c:819 [inline] sock_recvmsg net/socket.c:826 [inline] sock_recvmsg+0xc0/0x100 net/socket.c:822 SYSC_recvfrom+0x18c/0x290 net/socket.c:1815 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8880a540fd00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes to the right of 512-byte region [ffff8880a540fd00, ffff8880a540ff00) The buggy address belongs to the page: page:ffffea00029503c0 count:1 mapcount:0 mapping:ffff8880a540f080 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff8880a540f080 0000000000000000 0000000100000006 raw: ffffea00029e12a0 ffffea0002245560 ffff88812fe56940 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a540fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a540fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a540ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880a540ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a5410000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================