Hello,
I am still seeing these eap out-of-bounds writes in dummy_systimer_prepare. Even when we've disabled the hrtimer sysctl. The fuzzer does not change sysctls at the moment and I think we've overlooked a very simple possibility that can happen when sysctls are not changed (i.e. triggered by an unprivileged user).
dummy_pcm_open does:
static int dummy_pcm_open(struct snd_pcm_substream *substream) { ... dummy->timer_ops = &dummy_systimer_ops; #ifdef CONFIG_HIGH_RES_TIMERS if (hrtimer) dummy->timer_ops = &dummy_hrtimer_ops; #endif
There is a small window of time when we switch timer_ops to dummy_systimer_ops and then restore it back to dummy_hrtimer_ops. If another thread executes a timer op during that window, it happily smashes heap thinking that there is a systimer there.
KTSAN, a data race detector (https://github.com/google/ktsan), would catch this in a blink of an eye and give a detailed explanation of what happens...
================================================================== [ 134.926046] BUG: KASAN: slab-out-of-bounds in dummy_systimer_prepare+0x268/0x2a0 at addr ffff880030f00b10 [ 134.926046] Write of size 4 by task syz-executor/32211 [ 134.926046] ============================================================================= [ 134.926046] BUG kmalloc-192 (Not tainted): kasan: bad access detected [ 134.926046] ----------------------------------------------------------------------------- [ 134.926046] [ 134.926046] INFO: Allocated in dummy_hrtimer_create+0x49/0x1a0 age=5 cpu=0 pid=32211 [ 134.926046] ___slab_alloc+0x564/0x5b0 [ 134.926046] __slab_alloc+0x66/0xc0 [ 134.926046] kmem_cache_alloc_trace+0x25c/0x300 [ 134.931676] dummy_hrtimer_create+0x49/0x1a0 [ 134.931676] dummy_pcm_open+0xef/0x570 [ 134.932135] snd_pcm_open_substream+0x188/0x430 [ 134.932135] snd_pcm_oss_open.part.17+0x5a4/0x1110 [ 134.932135] snd_pcm_oss_open+0x35/0x50 [ 134.932135] soundcore_open+0x30f/0x640 [ 134.932135] chrdev_open+0x22a/0x4c0 [ 134.932135] do_dentry_open+0x6a2/0xcb0 [ 134.932135] vfs_open+0x17b/0x1f0 [ 134.932135] path_openat+0xde9/0x5e30 [ 134.932135] do_filp_open+0x18e/0x250 [ 134.932135] do_sys_open+0x1fc/0x420 [ 134.932135] SyS_open+0x2d/0x40
[ 134.932135] INFO: Freed in snd_pcm_plugin_free+0xb1/0xe0 age=20 cpu=0 pid=32142 [ 134.932135] __slab_free+0x1fc/0x320 [ 134.932135] kfree+0x2ac/0x2c0 [ 134.932135] snd_pcm_plugin_free+0xb1/0xe0 [ 134.932135] snd_pcm_oss_release_substream+0x113/0x1f0 [ 134.932135] snd_pcm_release_substream.part.38+0x1e8/0x2f0 [ 134.937048] snd_pcm_release_substream+0x59/0x70 [ 134.937048] snd_pcm_oss_release_file+0x7b/0xb0 [ 134.937048] snd_pcm_oss_release+0xfa/0x280 [ 134.937048] __fput+0x236/0x780 [ 134.937048] ____fput+0x15/0x20 [ 134.937048] task_work_run+0x170/0x210 [ 134.937048] do_exit+0x8b5/0x2cb0 [ 134.937048] do_group_exit+0x108/0x330 [ 134.937048] get_signal+0x5e4/0x14f0 [ 134.937048] do_signal+0x83/0x1c90 [ 134.937048] exit_to_usermode_loop+0x1a5/0x210
[ 134.937048] Call Trace: [ 134.937048] [<ffffffff82be30ad>] dump_stack+0x6f/0xa2 [ 134.937048] [<ffffffff8175c984>] print_trailer+0xf4/0x150 [ 134.937048] [<ffffffff8176370f>] object_err+0x2f/0x40 [ 134.937048] [<ffffffff81765fb6>] kasan_report_error+0x256/0x550 [ 134.937048] [<ffffffff81455748>] ? mark_held_locks+0xc8/0x120 [ 134.937048] [<ffffffff85223e23>] ? snd_power_wait+0x2e3/0x380 [ 134.937048] [<ffffffff817664ae>] __asan_report_store4_noabort+0x3e/0x40 [ 134.937048] [<ffffffff852e0f68>] ? dummy_systimer_prepare+0x268/0x2a0 [ 134.937048] [<ffffffff852e0f68>] dummy_systimer_prepare+0x268/0x2a0 [ 134.937048] [<ffffffff852e141b>] dummy_pcm_prepare+0x7b/0xa0 [ 134.937048] [<ffffffff852563ca>] snd_pcm_do_prepare+0x5a/0x90 [ 134.937048] [<ffffffff852556b6>] snd_pcm_action_single+0x76/0x120 [ 134.937048] [<ffffffff85255ab5>] snd_pcm_action_nonatomic+0x95/0xa0 [ 134.937048] [<ffffffff85260a05>] snd_pcm_common_ioctl1+0x1045/0x21a0 [ 134.937048] [<ffffffff86659c34>] ? __mutex_unlock_slowpath+0x1f4/0x430 [ 134.937048] [<ffffffff8525f9c0>] ? snd_pcm_status_user+0x140/0x140 [ 134.937048] [<ffffffff86659e79>] ? mutex_unlock+0x9/0x10 [ 134.937048] [<ffffffff8529649c>] ? snd_pcm_oss_change_params+0xb2c/0x3580 [ 134.937048] [<ffffffff85261e02>] snd_pcm_playback_ioctl1+0x2a2/0x5e0 [ 134.937048] [<ffffffff85295970>] ? snd_pcm_hw_param_near.constprop.26+0x8f0/0x8f0 [ 134.937048] [<ffffffff85261b60>] ? snd_pcm_common_ioctl1+0x21a0/0x21a0 [ 134.937048] [<ffffffff85262906>] snd_pcm_kernel_ioctl+0x136/0x160 [ 134.937048] [<ffffffff852908bb>] snd_pcm_oss_prepare+0x4b/0x200 [ 134.937048] [<ffffffff85298f9e>] snd_pcm_oss_make_ready+0xae/0x120 [ 134.937048] [<ffffffff8529f58f>] snd_pcm_oss_write+0x15f/0x700 [ 134.937048] [<ffffffff81456670>] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 134.937048] [<ffffffff817bacd3>] __vfs_write+0x113/0x4b0 [ 134.937048] [<ffffffff8529f430>] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 134.937048] [<ffffffff817babc0>] ? vfs_iter_write+0x360/0x360 [ 134.937048] [<ffffffff81493f27>] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 134.937048] [<ffffffff829e63c5>] ? common_file_perm+0x155/0x3a0 [ 134.937048] [<ffffffff829e6822>] ? apparmor_file_permission+0x22/0x30 [ 134.937048] [<ffffffff8291d07c>] ? security_file_permission+0x8c/0x1f0 [ 134.937048] [<ffffffff817bc162>] ? rw_verify_area+0x102/0x2c0 [ 134.937048] [<ffffffff817bc797>] vfs_write+0x167/0x4a0 [ 134.937048] [<ffffffff817bfa81>] SyS_write+0x111/0x220 [ 134.937048] [<ffffffff817bf970>] ? SyS_read+0x220/0x220 [ 134.937048] [<ffffffff81005017>] ? trace_hardirqs_on_thunk+0x17/0x19 [ 134.937048] [<ffffffff8665f176>] entry_SYSCALL_64_fastpath+0x16/0x7a [ 134.937048] ==================================================================
On commit df48ab3c2f5ffca88b7803ffbadd074bd5a0a2ef.