[BUG] KASAN: null-ptr-deref Write in go7007_snd_capture_open
From: Farhad Alemi
Date: Fri Sep 11 2026 - 13:48:55 EST
Hello,
We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 45.142456][ T9498] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI
[ 45.143557][ T9498] KASAN: null-ptr-deref in range
[0x0000000000000030-0x0000000000000037]
[ 45.144323][ T9498] CPU: 1 UID: 0 PID: 9498 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 45.145333][ T9498] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 45.146292][ T9498] RIP: 0010:kasan_byte_accessible+0x12/0x30
[ 45.147852][ T9498] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00
00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 50 74 99 09 cc 66 66 66
66 66 66 2e
[ 45.149580][ T9498] RSP: 0018:ffffc90002bc7538 EFLAGS: 00010006
[ 45.150138][ T9498] RAX: dffffc0000000000 RBX: ffffffff8bd0a8c0
RCX: 8000000000000002
[ 45.150849][ T9498] RDX: 0000000000000000 RSI: ffffffff8bd0a8c0
RDI: 0000000000000006
[ 45.151563][ T9498] RBP: ffffc90002bc77b0 R08: 0000000000000001
R09: 0000000000000000
[ 45.152280][ T9498] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000030
[ 45.152993][ T9498] R13: 0000000000000000 R14: 0000000000000030
R15: 0000000000000001
[ 45.153710][ T9498] FS: 00007f3769ddf6c0(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[ 45.154510][ T9498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 45.155167][ T9498] CR2: 00005652c681a960 CR3: 0000000026d97000
CR4: 0000000000752ef0
[ 45.155883][ T9498] PKRU: 55555554
[ 45.156215][ T9498] Call Trace:
[ 45.156525][ T9498] <TASK>
[ 45.156801][ T9498] __kasan_check_byte+0x12/0x40
[ 45.157260][ T9498] lock_acquire+0x7d/0x350
[ 45.157673][ T9498] ? __pfx_snd_pcm_hw_rule_add+0x10/0x10
[ 45.158975][ T9498] ? rcu_is_watching+0x16/0xb0
[ 45.159428][ T9498] _raw_spin_lock_irqsave+0x40/0x60
[ 45.159905][ T9498] ? go7007_snd_capture_open+0x69/0x110
[ 45.160417][ T9498] go7007_snd_capture_open+0x69/0x110
[ 45.160910][ T9498] snd_pcm_open_substream+0x1070/0x2420
[ 45.161431][ T9498] ? __pfx_snd_pcm_open_substream+0x10/0x10
[ 45.161973][ T9498] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 45.162509][ T9498] snd_pcm_open+0x202/0x670
[ 45.162931][ T9498] ? __pfx_snd_pcm_open+0x10/0x10
[ 45.163398][ T9498] ? __pfx_default_wake_function+0x10/0x10
[ 45.163931][ T9498] snd_pcm_capture_open+0x62/0xc0
[ 45.164425][ T9498] chrdev_open+0x4cd/0x5e0
[ 45.164920][ T9498] ? __pfx_chrdev_open+0x10/0x10
[ 45.165406][ T9498] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[ 45.166006][ T9498] ? __pfx_chrdev_open+0x10/0x10
[ 45.166467][ T9498] do_dentry_open+0x822/0x13a0
[ 45.166917][ T9498] vfs_open+0x3b/0x340
[ 45.167299][ T9498] ? path_openat+0x1552/0x1f30
[ 45.167742][ T9498] path_openat+0x1569/0x1f30
[ 45.168177][ T9498] do_file_open+0x23e/0x4a0
[ 45.168596][ T9498] ? __pfx_do_file_open+0x10/0x10
[ 45.169064][ T9498] ? alloc_fd+0x676/0x6f0
[ 45.169463][ T9498] do_sys_openat2+0x115/0x200
[ 45.169898][ T9498] ? __pfx_do_sys_openat2+0x10/0x10
[ 45.170381][ T9498] ? rcu_is_watching+0x16/0xb0
[ 45.170827][ T9498] __x64_sys_openat+0x138/0x170
[ 45.171281][ T9498] do_syscall_64+0x155/0x510
[ 45.171710][ T9498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.172268][ T9498] ? clear_bhb_loop+0x30/0x80
[ 45.172702][ T9498] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.173243][ T9498] RIP: 0033:0x436ac2
[ 45.173609][ T9498] Code: 08 0f 85 41 df ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 45.175407][ T9498] RSP: 002b:00007f3769ddf118 EFLAGS: 00000246
ORIG_RAX: 0000000000000101
[ 45.176163][ T9498] RAX: ffffffffffffffda RBX: 00007f3769ddf6c0
RCX: 0000000000436ac2
[ 45.176875][ T9498] RDX: 0000000000000800 RSI: 00000000004d0cc0
RDI: ffffffffffffff9c
[ 45.177592][ T9498] RBP: 00007f3769ddf140 R08: 0000000000000000
R09: 0000000000000000
[ 45.178312][ T9498] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f3769ddf6c0
[ 45.179027][ T9498] R13: 00007ffde95ff8a0 R14: 00007f3769ddfce4
R15: 00007ffde95ff997
[ 45.179745][ T9498] </TASK>
[ 45.180033][ T9498] Modules linked in:
[ 45.180405][ T9498] ---[ end trace 0000000000000000 ]---
[ 45.180900][ T9498] RIP: 0010:kasan_byte_accessible+0x12/0x30
[ 45.180914][ T9498] Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00
00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 50 74 99 09 cc 66 66 66
66 66 66 2e
[ 45.180920][ T9498] RSP: 0018:ffffc90002bc7538 EFLAGS: 00010006
[ 45.180926][ T9498] RAX: dffffc0000000000 RBX: ffffffff8bd0a8c0
RCX: 8000000000000002
[ 45.180931][ T9498] RDX: 0000000000000000 RSI: ffffffff8bd0a8c0
RDI: 0000000000000006
[ 45.180935][ T9498] RBP: ffffc90002bc77b0 R08: 0000000000000001
R09: 0000000000000000
[ 45.180939][ T9498] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000030
[ 45.180943][ T9498] R13: 0000000000000000 R14: 0000000000000030
R15: 0000000000000001
[ 45.180947][ T9498] FS: 00007f3769ddf6c0(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[ 45.180953][ T9498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 45.180957][ T9498] CR2: 00005652c681a960 CR3: 0000000026d97000
CR4: 0000000000752ef0
[ 45.180963][ T9498] PKRU: 55555554
[ 45.180969][ T9498] Kernel panic - not syncing: Fatal exception
[ 45.190841][ T9498] Kernel Offset: disabled
[ 45.191392][ T9498] Rebooting in 86400 seconds..
Regards,
Attachment:
reproducer.c
Description: Binary data