On Fri, 09 Mar 2018 21:59:03 +0100, syzbot wrote:
Hello,
syzbot hit the following crash on upstream commit 1b88accf6a659c46d5c8e68912896f112bf882bb (Thu Mar 8 01:49:33 2018 +0000) Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
So far this crash happened 3 times on upstream. C reproducer is attached. syzkaller reproducer is attached. Raw console output is attached. compiler: gcc (GCC) 7.1.1 20170620 .config is attached.
IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer.
IPVS: ftp: loaded support on port[0] = 21 audit: type=1400 audit(1520612143.836:8): avc: denied { map } for pid=4259 comm="syzkaller191035" path="/dev/dsp1" dev="devtmpfs" ino=1250 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 ================================================================== BUG: KASAN: use-after-free in snd_mask_test include/sound/pcm_params.h:141 [inline] BUG: KASAN: use-after-free in snd_pcm_oss_get_formats+0x320/0x380 sound/core/oss/pcm_oss.c:1770
Doh, this is a so-clear UAF, shining brightly in the code. Will submit / merge the fix patch.
thanks,
Takashi