lkml.org 
[lkml]   [2018]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in snd_pcm_oss_get_formats
On Fri, 09 Mar 2018 21:59:03 +0100,
syzbot wrote:
>
> Hello,
>
> syzbot hit the following crash on upstream commit
> 1b88accf6a659c46d5c8e68912896f112bf882bb (Thu Mar 8 01:49:33 2018 +0000)
> Merge tag 'for_linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
>
> So far this crash happened 3 times on upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> IPVS: ftp: loaded support on port[0] = 21
> audit: type=1400 audit(1520612143.836:8): avc: denied { map } for
> pid=4259 comm="syzkaller191035" path="/dev/dsp1" dev="devtmpfs"
> ino=1250 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file
> permissive=1
> IPVS: ftp: loaded support on port[0] = 21
> IPVS: ftp: loaded support on port[0] = 21
> ==================================================================
> BUG: KASAN: use-after-free in snd_mask_test
> include/sound/pcm_params.h:141 [inline]
> BUG: KASAN: use-after-free in snd_pcm_oss_get_formats+0x320/0x380
> sound/core/oss/pcm_oss.c:1770

Doh, this is a so-clear UAF, shining brightly in the code.
Will submit / merge the fix patch.


thanks,

Takashi

\
 
 \ /
  Last update: 2018-03-11 22:46    [W:0.086 / U:3.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site