From: syzbot <syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com>
To: isely@pobox.com, linux-kernel@vger.kernel.org,
linux-media@vger.kernel.org, mchehab@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] UBSAN: array-index-out-of-bounds in pvr2_i2c_core_init
Date: Thu, 14 Apr 2022 11:47:21 -0700 [thread overview]
Message-ID: <0000000000005abf2305dca1b91b@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 4ea3c6425269 Merge tag 'powerpc-5.18-2' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=148cb824f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=307baecfd5e87ced
dashboard link: https://syzkaller.appspot.com/bug?extid=1a247e36149ffd709a9b
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17279a70f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=121dc124f00000
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=142753df700000
final oops: https://syzkaller.appspot.com/x/report.txt?x=162753df700000
console output: https://syzkaller.appspot.com/x/log.txt?x=122753df700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com
pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem.
pvrusb2: Invalid write control endpoint
================================================================================
UBSAN: array-index-out-of-bounds in drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:602:13
index -1 is out of range for type 'int [20]'
CPU: 0 PID: 1959 Comm: pvrusb2-context Not tainted 5.18.0-rc1-syzkaller-00401-g4ea3c6425269 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
ubsan_epilogue+0xb/0x50 lib/ubsan.c:151
__ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:283
pvr2_i2c_core_init+0xc7d/0xd30 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:602
pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2134 [inline]
pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2261 [inline]
pvr2_hdw_initialize+0x787/0x37d0 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2338
pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:109 [inline]
pvr2_context_thread_func+0x250/0x850 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
================================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 1959 Comm: pvrusb2-context Not tainted 5.18.0-rc1-syzkaller-00401-g4ea3c6425269 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
panic+0x2d7/0x636 kernel/panic.c:250
ubsan_epilogue+0x4a/0x50 lib/ubsan.c:158
__ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:283
pvr2_i2c_core_init+0xc7d/0xd30 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:602
pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2134 [inline]
pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2261 [inline]
pvr2_hdw_initialize+0x787/0x37d0 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2338
pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:109 [inline]
pvr2_context_thread_func+0x250/0x850 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
next reply other threads:[~2022-04-14 18:47 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-14 18:47 syzbot [this message]
2022-04-14 20:04 ` [syzbot] UBSAN: array-index-out-of-bounds in pvr2_i2c_core_init Pavel Skripkin
2022-04-14 20:14 ` syzbot
2022-04-14 20:18 ` Pavel Skripkin
2022-04-14 23:31 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000005abf2305dca1b91b@google.com \
--to=syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com \
--cc=isely@pobox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.