[alsa-devel] sound: WARNING in snd_seq_oss_synth_cleanup

[Dmitry Vyukov]

Hello,

The following program triggers WARNING in snd_seq_oss_synth_cleanup:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
snd_seq_oss_synth_cleanup+0x35f/0x420()
Modules linked in:
CPU: 1 PID: 7573 Comm: a.out Tainted: G        W       4.4.0+ #276
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000
 ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089
 ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff84fd380f>] snd_seq_oss_synth_cleanup+0x35f/0x420
sound/core/seq/oss/seq_oss_synth.c:311
 [<ffffffff84fca919>] snd_seq_oss_release+0x79/0x130
sound/core/seq/oss/seq_oss_init.c:427
 [<ffffffff84fc8faa>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155
 [<ffffffff817b73c6>] __fput+0x236/0x780 fs/file_table.c:208
 [<ffffffff817b7995>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff813afdc0>] task_work_run+0x170/0x210 kernel/task_work.c:115
 [<     inline     >] exit_task_work include/linux/task_work.h:21
 [<ffffffff8135b275>] do_exit+0x8b5/0x2c60 kernel/exit.c:750
 [<ffffffff8135d798>] do_group_exit+0x108/0x330 kernel/exit.c:880
 [<     inline     >] SYSC_exit_group kernel/exit.c:891
 [<ffffffff8135d9dd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:889
 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace e71270304b7f911a ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main()
{
    open("/dev/char/14:8", O_RDWR);
}

On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2.