KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params

[Greg KH]

On Fri, Jul 22, 2022 at 09:37:52AM -0700, Dipanjan Das wrote:
> Hi,
> 
> We would like to report the following bug which has been found by our
> modified version of syzkaller.
> 
> ======================================================
> description: KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params
> affected file: sound/core/pcm_native.c
> kernel version: 5.10.131
> kernel commit: de62055f423f5dcb548f74cebd68f03c8903f73a
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
> crash reproducer: attached
> ======================================================
> Crash log:
> ======================================================
> BUG: KASAN: vmalloc-out-of-bounds in memset include/linux/string.h:384 [inline]
> BUG: KASAN: vmalloc-out-of-bounds in snd_pcm_hw_params+0x19b0/0x1db0
> sound/core/pcm_native.c:799
> Write of size 2097152 at addr ffffc900113b2000 by task syz-executor.5/14437
> 
> CPU: 1 PID: 14437 Comm: syz-executor.5 Tainted: G           OE     5.10.131+ #3
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x107/0x163 lib/dump_stack.c:118
>  print_address_description.constprop.0.cold+0x5/0x4f7 mm/kasan/report.c:385
>  __kasan_report mm/kasan/report.c:545 [inline]
>  kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
>  check_memory_region_inline mm/kasan/generic.c:194 [inline]
>  check_memory_region+0x187/0x1e0 mm/kasan/generic.c:200
>  memset+0x20/0x40 mm/kasan/common.c:85
>  memset include/linux/string.h:384 [inline]
>  snd_pcm_hw_params+0x19b0/0x1db0 sound/core/pcm_native.c:799
>  snd_pcm_kernel_ioctl+0xd1/0x240 sound/core/pcm_native.c:3401
>  snd_pcm_oss_change_params_locked+0x17b6/0x3aa0 sound/core/oss/pcm_oss.c:965
>  snd_pcm_oss_change_params+0x76/0xd0 sound/core/oss/pcm_oss.c:1107
>  snd_pcm_oss_make_ready+0xb7/0x170 sound/core/oss/pcm_oss.c:1166
>  snd_pcm_oss_set_trigger.isra.0+0x34f/0x770 sound/core/oss/pcm_oss.c:2074
>  snd_pcm_oss_poll+0x679/0xb40 sound/core/oss/pcm_oss.c:2858
>  vfs_poll include/linux/poll.h:90 [inline]
>  do_pollfd fs/select.c:872 [inline]
>  do_poll fs/select.c:920 [inline]
>  do_sys_poll+0x63c/0xe40 fs/select.c:1014
>  __do_sys_poll fs/select.c:1079 [inline]
>  __se_sys_poll fs/select.c:1067 [inline]
>  __x64_sys_poll+0x18c/0x490 fs/select.c:1067
>  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7f095de4f4ed
> Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f095bdffbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
> RAX: ffffffffffffffda RBX: 00007f095df6df60 RCX: 00007f095de4f4ed
> RDX: 0000000000000009 RSI: 0000000000000001 RDI: 00000000200000c0
> RBP: 00007f095bdffc40 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001d
> R13: 00007ffff286ceff R14: 00007f095df6df60 R15: 00007f095bdffd80
> 
> 
> Memory state around the buggy address:
>  ffffc900115b1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>  ffffc900115b1d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >ffffc900115b1e00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>                    ^
>  ffffc900115b1e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>  ffffc900115b1f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
> ==================================================================

Wondeful, do you have a fix for this that solves the reported problem
that you have tested with the reproducer?

thanks,

greg k-h