From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD71ACA9EA0 for ; Tue, 22 Oct 2019 15:46:14 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A7891214B2 for ; Tue, 22 Oct 2019 15:46:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=alsa-project.org header.i=@alsa-project.org header.b="E7QNLVH2" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A7891214B2 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=alsa-devel-bounces@alsa-project.org Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 507EC1614; Tue, 22 Oct 2019 17:45:21 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 507EC1614 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1571759171; bh=mYh/Jvhcg5tx9ThgltPfwbSahb0Non2Joq36YfWnr4c=; h=Date:From:To:In-Reply-To:References:Cc:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=E7QNLVH2mUSvCQgnVHASJB5c3IvXyOSmo2Fu733ncT/NjguaVMbGkXCO4tkFSRYzx wHkg6FvMWqwaEDR1Logs6GbN5diOpzuvzYITLawVz13B69XctV0HyP33WL41xyavxP VsPf4D6sM2vGxSmu4W5SQIySq95qEE1yRrzBgYPQ= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id D3368F8026A; Tue, 22 Oct 2019 17:45:20 +0200 (CEST) Received: by alsa1.perex.cz (Postfix, from userid 50401) id C6930F8031A; Tue, 22 Oct 2019 17:45:19 +0200 (CEST) Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 40A94F8026A for ; Tue, 22 Oct 2019 17:45:16 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 40A94F8026A X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id AA4ABB44E; Tue, 22 Oct 2019 15:45:15 +0000 (UTC) Date: Tue, 22 Oct 2019 17:45:14 +0200 Message-ID: From: Takashi Iwai To: syzbot In-Reply-To: <000000000000df5189059580f8e9@google.com> References: <000000000000df5189059580f8e9@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Cc: alsa-devel@alsa-project.org, g@b4.vu, yuehaibing@huawei.com, andreyknvl@google.com, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, rfontana@redhat.com, tiwai@suse.com, benquike@gmail.com, dan.carpenter@oracle.com Subject: Re: [alsa-devel] KASAN: slab-out-of-bounds Read in build_audio_procunit X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Tue, 22 Oct 2019 16:54:07 +0200, syzbot wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit: 22be26f7 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=103893cf600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=387eccb7ac68ec5 > dashboard link: https://syzkaller.appspot.com/bug?extid=0620f79a1978b1133fd7 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16fd6a40e00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1033215f600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+0620f79a1978b1133fd7@syzkaller.appspotmail.com > > usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 > usb 1-1: Product: syz > usb 1-1: Manufacturer: syz > usb 1-1: SerialNumber: syz > ================================================================== > BUG: KASAN: slab-out-of-bounds in uac_processing_unit_iProcessing > include/uapi/linux/usb/audio.h:429 [inline] > BUG: KASAN: slab-out-of-bounds in build_audio_procunit+0x1306/0x13f0 > sound/usb/mixer.c:2436 > Read of size 1 at addr ffff8881d537c7b7 by task kworker/0:2/101 > > CPU: 0 PID: 101 Comm: kworker/0:2 Not tainted 5.4.0-rc3+ #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, > BIOS Google 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xca/0x13e lib/dump_stack.c:113 > print_address_description.constprop.0+0x36/0x50 mm/kasan/report.c:374 > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:506 > kasan_report+0xe/0x20 mm/kasan/common.c:634 > uac_processing_unit_iProcessing include/uapi/linux/usb/audio.h:429 [inline] > build_audio_procunit+0x1306/0x13f0 sound/usb/mixer.c:2436 > parse_audio_processing_unit sound/usb/mixer.c:2468 [inline] > parse_audio_unit+0x17e9/0x36f0 sound/usb/mixer.c:2757 > snd_usb_mixer_controls+0x715/0xb90 sound/usb/mixer.c:3095 > snd_usb_create_mixer+0x2b5/0x1890 sound/usb/mixer.c:3445 > usb_audio_probe+0xc76/0x2010 sound/usb/card.c:653 > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > really_probe+0x281/0x6d0 drivers/base/dd.c:548 > driver_probe_device+0x104/0x210 drivers/base/dd.c:721 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828 > bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430 > __device_attach+0x217/0x360 drivers/base/dd.c:894 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490 > device_add+0xae6/0x16f0 drivers/base/core.c:2201 > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > really_probe+0x281/0x6d0 drivers/base/dd.c:548 > driver_probe_device+0x104/0x210 drivers/base/dd.c:721 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828 > bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430 > __device_attach+0x217/0x360 drivers/base/dd.c:894 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490 > device_add+0xae6/0x16f0 drivers/base/core.c:2201 > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > hub_port_connect drivers/usb/core/hub.c:5183 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5323 [inline] > port_event drivers/usb/core/hub.c:5469 [inline] > hub_event+0x1dd0/0x37e0 drivers/usb/core/hub.c:5551 > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > kthread+0x318/0x420 kernel/kthread.c:255 > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Damn, there was a silly copy&paste error in the validation code. The fix patch is below. I'm going to queue this for the next pull request for 5.4. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: usb-audio: Fix copy&paste error in the validator The recently introduced USB-audio descriptor validator had a stupid copy&paste error that may lead to an unexpected overlook of too short descriptors for processing and extension units. It's likely the cause of the report triggered by syzkaller fuzzer. Let's fix it. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Reported-by: syzbot+0620f79a1978b1133fd7@syzkaller.appspotmail.com Signed-off-by: Takashi Iwai --- sound/usb/validate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/validate.c b/sound/usb/validate.c index 3c8f73a0eb12..a5e584b60dcd 100644 --- a/sound/usb/validate.c +++ b/sound/usb/validate.c @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p, if (d->bLength < sizeof(*d)) return false; - len = d->bLength < sizeof(*d) + d->bNrInPins; + len = sizeof(*d) + d->bNrInPins; if (d->bLength < len) return false; switch (v->protocol) { -- 2.16.4 _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel