Re: KASAN: use-after-free Read in snd_pcm_oss_get_formats

[Takashi Iwai]

On Fri, 09 Mar 2018 21:59:03 +0100,
syzbot wrote:
> 
> Hello,
> 
> syzbot hit the following crash on upstream commit
> 1b88accf6a659c46d5c8e68912896f112bf882bb (Thu Mar 8 01:49:33 2018 +0000)
> Merge tag 'for_linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
> 
> So far this crash happened 3 times on upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+4090700a4f13fccaf648@xxxxxxxxxxxxxxxxxxxxxxxxx
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
> 
> IPVS: ftp: loaded support on port[0] = 21
> audit: type=1400 audit(1520612143.836:8): avc:  denied  { map } for
> pid=4259 comm="syzkaller191035" path="/dev/dsp1" dev="devtmpfs"
> ino=1250  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file
> permissive=1
> IPVS: ftp: loaded support on port[0] = 21
> IPVS: ftp: loaded support on port[0] = 21
> ==================================================================
> BUG: KASAN: use-after-free in snd_mask_test
> include/sound/pcm_params.h:141  [inline]
> BUG: KASAN: use-after-free in snd_pcm_oss_get_formats+0x320/0x380
> sound/core/oss/pcm_oss.c:1770

Doh, this is a so-clear UAF, shining brightly in the code.
Will submit / merge the fix patch.


thanks,

Takashi