KASAN: slab-out-of-bounds Read in resample_shrink

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 12cd844a Linux 4.14.173
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1183321de00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8a9d0602a0f7791e
dashboard link: https://syzkaller.appspot.com/bug?extid=e70ea926fbff88a9bdbf
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12657dc3e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12814475e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e70ea9...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160
Read of size 2 at addr ffff8880a540ff00 by task syz-executor756/7483

CPU: 1 PID: 7483 Comm: syz-executor756 Not tainted 4.14.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x13e/0x194 lib/dump_stack.c:58
print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393
resample_shrink+0x55e/0x6a0 sound/core/oss/rate.c:160
rate_transfer sound/core/oss/rate.c:279 [inline]
rate_transfer+0x1b2/0x250 sound/core/oss/rate.c:249
snd_pcm_plug_read_transfer+0x14f/0x250 sound/core/oss/pcm_plugin.c:650
snd_pcm_oss_read2+0x1ac/0x340 sound/core/oss/pcm_oss.c:1475
snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1532 [inline]
snd_pcm_oss_read+0x486/0x5e0 sound/core/oss/pcm_oss.c:2753
do_loop_readv_writev fs/read_write.c:695 [inline]
do_loop_readv_writev fs/read_write.c:682 [inline]
do_iter_read+0x3e3/0x5a0 fs/read_write.c:919
vfs_readv+0xd3/0x130 fs/read_write.c:981
do_readv+0xfc/0x2c0 fs/read_write.c:1014
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446c59
RSP: 002b:00007f2fcf884db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000446c59
RDX: 0000000000000001 RSI: 0000000020395000 RDI: 0000000000000003
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c
R13: 00007fff729b479f R14: 00007f2fcf8859c0 R15: 20c49ba5e353f7cf

Allocated by task 7483:
save_stack+0x32/0xa0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529
__do_kmalloc_node mm/slab.c:3682 [inline]
__kmalloc_node+0x4c/0x70 mm/slab.c:3689
kmalloc_node include/linux/slab.h:530 [inline]
kvmalloc_node+0x46/0xd0 mm/util.c:397
kvmalloc include/linux/mm.h:531 [inline]
kvzalloc include/linux/mm.h:539 [inline]
snd_pcm_plugin_alloc+0x4cf/0x700 sound/core/oss/pcm_plugin.c:70
snd_pcm_plug_alloc+0x13e/0x300 sound/core/oss/pcm_plugin.c:129
snd_pcm_oss_change_params_locked+0x1c0d/0x30a0 sound/core/oss/pcm_oss.c:1039
snd_pcm_oss_change_params+0x5e/0xb0 sound/core/oss/pcm_oss.c:1102
snd_pcm_oss_get_active_substream+0xf5/0x140 sound/core/oss/pcm_oss.c:1119
snd_pcm_oss_get_rate sound/core/oss/pcm_oss.c:1769 [inline]
snd_pcm_oss_set_rate sound/core/oss/pcm_oss.c:1761 [inline]
snd_pcm_oss_ioctl+0xbe7/0x2b00 sound/core/oss/pcm_oss.c:2609
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 3716:
save_stack+0x32/0xa0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcb/0x260 mm/slab.c:3815
skb_free_head+0x83/0xa0 net/core/skbuff.c:554
skb_release_data+0x528/0x7b0 net/core/skbuff.c:574
skb_release_all+0x46/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
consume_skb+0xa7/0x330 net/core/skbuff.c:705
skb_free_datagram+0x16/0xe0 net/core/datagram.c:331
unix_dgram_recvmsg+0x70a/0xcd0 net/unix/af_unix.c:2207
sock_recvmsg_nosec net/socket.c:819 [inline]
sock_recvmsg net/socket.c:826 [inline]
sock_recvmsg+0xc0/0x100 net/socket.c:822
SYSC_recvfrom+0x18c/0x290 net/socket.c:1815
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8880a540fd00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes to the right of
512-byte region [ffff8880a540fd00, ffff8880a540ff00)
The buggy address belongs to the page:
page:ffffea00029503c0 count:1 mapcount:0 mapping:ffff8880a540f080 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff8880a540f080 0000000000000000 0000000100000006
raw: ffffea00029e12a0 ffffea0002245560 ffff88812fe56940 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8880a540fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880a540fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880a540ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8880a540ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880a5410000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches