Re: KASAN: slab-out-of-bounds Read in build_audio_procunit

[Takashi Iwai]

On Tue, 22 Oct 2019 16:54:07 +0200,
syzbot wrote:
> 
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    22be26f7 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=103893cf600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=387eccb7ac68ec5
> dashboard link: https://syzkaller.appspot.com/bug?extid=0620f79a1978b1133fd7
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16fd6a40e00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1033215f600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0620f79a1978b1133fd7@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
> usb 1-1: Product: syz
> usb 1-1: Manufacturer: syz
> usb 1-1: SerialNumber: syz
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in uac_processing_unit_iProcessing
> include/uapi/linux/usb/audio.h:429 [inline]
> BUG: KASAN: slab-out-of-bounds in build_audio_procunit+0x1306/0x13f0
> sound/usb/mixer.c:2436
> Read of size 1 at addr ffff8881d537c7b7 by task kworker/0:2/101
> 
> CPU: 0 PID: 101 Comm: kworker/0:2 Not tainted 5.4.0-rc3+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS  Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0xca/0x13e lib/dump_stack.c:113
>  print_address_description.constprop.0+0x36/0x50 mm/kasan/report.c:374
>  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:506
>  kasan_report+0xe/0x20 mm/kasan/common.c:634
>  uac_processing_unit_iProcessing include/uapi/linux/usb/audio.h:429 [inline]
>  build_audio_procunit+0x1306/0x13f0 sound/usb/mixer.c:2436
>  parse_audio_processing_unit sound/usb/mixer.c:2468 [inline]
>  parse_audio_unit+0x17e9/0x36f0 sound/usb/mixer.c:2757
>  snd_usb_mixer_controls+0x715/0xb90 sound/usb/mixer.c:3095
>  snd_usb_create_mixer+0x2b5/0x1890 sound/usb/mixer.c:3445
>  usb_audio_probe+0xc76/0x2010 sound/usb/card.c:653
>  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
>  really_probe+0x281/0x6d0 drivers/base/dd.c:548
>  driver_probe_device+0x104/0x210 drivers/base/dd.c:721
>  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
>  bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
>  __device_attach+0x217/0x360 drivers/base/dd.c:894
>  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
>  device_add+0xae6/0x16f0 drivers/base/core.c:2201
>  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
>  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
>  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
>  really_probe+0x281/0x6d0 drivers/base/dd.c:548
>  driver_probe_device+0x104/0x210 drivers/base/dd.c:721
>  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
>  bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
>  __device_attach+0x217/0x360 drivers/base/dd.c:894
>  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
>  device_add+0xae6/0x16f0 drivers/base/core.c:2201
>  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
>  hub_port_connect drivers/usb/core/hub.c:5183 [inline]
>  hub_port_connect_change drivers/usb/core/hub.c:5323 [inline]
>  port_event drivers/usb/core/hub.c:5469 [inline]
>  hub_event+0x1dd0/0x37e0 drivers/usb/core/hub.c:5551
>  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
>  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
>  kthread+0x318/0x420 kernel/kthread.c:255
>  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Damn, there was a silly copy&paste error in the validation code.
The fix patch is below.  I'm going to queue this for the next pull
request for 5.4.


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@xxxxxxx>
Subject: [PATCH] ALSA: usb-audio: Fix copy&paste error in the validator

The recently introduced USB-audio descriptor validator had a stupid
copy&paste error that may lead to an unexpected overlook of too short
descriptors for processing and extension units.  It's likely the cause
of the report triggered by syzkaller fuzzer.  Let's fix it.

Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units")
Reported-by: syzbot+0620f79a1978b1133fd7@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
 sound/usb/validate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/validate.c b/sound/usb/validate.c
index 3c8f73a0eb12..a5e584b60dcd 100644
--- a/sound/usb/validate.c
+++ b/sound/usb/validate.c
@@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p,
 
 	if (d->bLength < sizeof(*d))
 		return false;
-	len = d->bLength < sizeof(*d) + d->bNrInPins;
+	len = sizeof(*d) + d->bNrInPins;
 	if (d->bLength < len)
 		return false;
 	switch (v->protocol) {
-- 
2.16.4