On Wed, 04 Dec 2019 09:25:09 +0100, syzbot wrote:
Hello,
syzbot found the following crash on:
HEAD commit: 76bb8b05 Merge tag 'kbuild-v5.5' of git://git.kernel.org/p.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1416a90ee00000 kernel config: https://syzkaller.appspot.com/x/.config?x=dd226651cb0f364b dashboard link: https://syzkaller.appspot.com/bug?extid=f153bde47a62e0b05f83 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10fe9e41e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1522042ae00000
The bug was bisected to:
commit 65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476 Author: Takashi Iwai tiwai@suse.de Date: Fri Nov 9 10:59:45 2018 +0000
ALSA: oss: Use kvzalloc() for local buffer allocations
FYI, this bisection result is bogus; before this commit, the buffer was allocated via vmalloc and KASAN check was skipped. Now with kvmalloc(), it goes with kmalloc which has a proper check, and the problem surfaced since this commit.
The real culprit is a potential buffer overflow in the OSS plugin chain. I submitted the fix patch now.
Takashi