From: syzbot <syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com>
To: jikos@kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, tintinm2017@gmail.com
Subject: Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
Date: Sat, 23 Dec 2023 12:29:07 -0800 [thread overview]
Message-ID: <0000000000003ca6b6060d332f49@google.com> (raw)
In-Reply-To: <20231223195641.29000-1-tintinm2017@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in usbhid_parse
usb 1-1: string descriptor 0 read error: -22
usb 1-1: New USB device found, idVendor=080e, idProduct=4eb9, bcdDevice=d7.f6
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
================================================================================
UBSAN: array-index-out-of-bounds in drivers/hid/usbhid/hid-core.c:1026:18
index 1 is out of range for type 'hid_class_descriptor [1]'
CPU: 0 PID: 5070 Comm: kworker/0:5 Not tainted 6.7.0-rc6-syzkaller-00248-g5254c0cbc92d-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:348
usbhid_parse+0x99d/0xa10 drivers/hid/usbhid/hid-core.c:1026
hid_add_device+0x189/0xa60 drivers/hid/hid-core.c:2790
usbhid_probe+0xd0a/0x1360 drivers/hid/usbhid/hid-core.c:1431
usb_probe_interface+0x307/0x930 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3625
usb_set_configuration+0x10cb/0x1c40 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0xca/0x130 drivers/usb/core/generic.c:238
usb_probe_device+0xda/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3625
usb_new_device+0xd80/0x19f0 drivers/usb/core/hub.c:2576
hub_port_connect drivers/usb/core/hub.c:5440 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5580 [inline]
port_event drivers/usb/core/hub.c:5740 [inline]
hub_event+0x2dac/0x4e10 drivers/usb/core/hub.c:5822
process_one_work+0x884/0x15c0 kernel/workqueue.c:2627
process_scheduled_works kernel/workqueue.c:2700 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
kthread+0x33c/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
================================================================================
Tested on:
commit: 5254c0cb Merge tag 'block-6.7-2023-12-22' of git://git..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=14446681e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7c68d9298a873f9e
dashboard link: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13af6e26e80000
next parent reply other threads:[~2023-12-23 20:29 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20231223195641.29000-1-tintinm2017@gmail.com>
2023-12-23 20:29 ` syzbot [this message]
[not found] <20231121191815.201459-1-tintinm2017@gmail.com>
2023-11-21 20:27 ` [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
[not found] <CAJjsb4qSx1FGaj6N0HXJp7cJEo1BQWyYgxTcXVcFNbc5bRZKxA@mail.gmail.com>
2023-11-17 14:39 ` syzbot
[not found] <20231017104539.1939-1-hdanton@sina.com>
2023-10-17 11:17 ` syzbot
2023-10-16 17:01 syzbot
2024-05-23 14:17 ` Nikita Zhandarovich
2024-05-24 1:56 ` syzbot
2025-01-30 10:20 ` Nikita Zhandarovich
2025-01-30 14:14 ` syzbot
2025-01-31 7:13 ` Nikita Zhandarovich
2025-01-31 7:39 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000003ca6b6060d332f49@google.com \
--to=syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com \
--cc=jikos@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tintinm2017@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.