WARNING in snd_pcm_plug_client_channels_buf

[syzbot]

Hello,

syzbot hit the following crash on upstream commit
d8a5b80568a9cb66810e75b182018e9edb68e8ff (Sun Jan 28 21:20:33 2018 +0000)
Linux 4.15

Unfortunately, I don't have any reproducer for this crash yet.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.
user-space arch: i386

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+687aa4...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

Free swap = 0kB
Total swap = 0kB
1965969 pages RAM
0 pages HighMem/MovableOnly
328405 pages reserved
WARNING: CPU: 0 PID: 17289 at sound/core/oss/pcm_plugin.c:559
snd_pcm_plug_client_channels_buf+0x350/0x3f0 sound/core/oss/pcm_plugin.c:559
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 17289 Comm: syz-executor1 Not tainted 4.15.0+ #195
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1096
RIP: 0010:snd_pcm_plug_client_channels_buf+0x350/0x3f0
sound/core/oss/pcm_plugin.c:559
RSP: 0018:ffff8801adbdf888 EFLAGS: 00010212
RAX: 0000000000010000 RBX: 1ffff10035b7bf1f RCX: ffffffff8422b930
RDX: 00000000000074d6 RSI: ffffc90004731000 RDI: ffff8801d251897c
RBP: ffff8801adbdf8c8 R08: ffff8801b262fa70 R09: 1ffff10035b7be8e
R10: ffff8801adbdf980 R11: 0000000000000001 R12: ffff8801adbdf918
R13: 0000000000000000 R14: ffff8801d2518940 R15: ffff8801adbdf958
snd_pcm_oss_read2+0x1cf/0x410 sound/core/oss/pcm_oss.c:1412
snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1451 [inline]
snd_pcm_oss_read+0x438/0x760 sound/core/oss/pcm_oss.c:2636
do_loop_readv_writev fs/read_write.c:673 [inline]
do_iter_read+0x3d2/0x5a0 fs/read_write.c:897
compat_readv+0x1bf/0x270 fs/read_write.c:1140
do_compat_readv+0x115/0x220 fs/read_write.c:1160
C_SYSC_readv fs/read_write.c:1172 [inline]
compat_SyS_readv+0x26/0x30 fs/read_write.c:1168
do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129
RIP: 0023:0xf7f7ac79
RSP: 002b:00000000f775508c EFLAGS: 00000296 ORIG_RAX: 0000000000000091
RAX: ffffffffffffffda RBX: 0000000000000014 RCX: 0000000020ddcff0
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.