From: syzbot <syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com>
To: contact@arnaud-lcm.com, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
manas18244@iiitd.ac.in, stern@rowland.harvard.edu,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [usb?] KASAN: slab-out-of-bounds Read in mon_copy_to_buff
Date: Mon, 07 Jul 2025 11:41:04 -0700 [thread overview]
Message-ID: <686c14c0.a00a0220.6237c.0000.GAE@google.com> (raw)
In-Reply-To: <5de04492-01d3-4b2c-b3f4-8c2237dfed6a@rowland.harvard.edu>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-out-of-bounds Read in mon_copy_to_buff
microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
usbhid 1-1:0.0: count 0 reportnum 0 buf[0] 0
==================================================================
BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
Read of size 3904 at addr ffff8880222d53c1 by task kworker/1:2/3689
CPU: 1 UID: 0 PID: 3689 Comm: kworker/1:2 Not tainted 6.16.0-rc5-syzkaller-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
__asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
mon_bin_get_data drivers/usb/mon/mon_bin.c:420 [inline]
mon_bin_event+0x1071/0x2050 drivers/usb/mon/mon_bin.c:606
mon_bus_submit+0xcf/0x140 drivers/usb/mon/mon_main.c:89
usbmon_urb_submit include/linux/usb/hcd.h:724 [inline]
usb_hcd_submit_urb+0x12d/0x1c60 drivers/usb/core/hcd.c:1518
usb_submit_urb+0x87c/0x1790 drivers/usb/core/urb.c:581
usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:929 [inline]
usbhid_raw_request+0x29a/0x710 drivers/hid/usbhid/hid-core.c:1300
__hid_request+0x296/0x3c0 drivers/hid/hid-core.c:1989
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1436
usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5866 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5948
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 3689:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4340
__hid_request+0x2c/0x3c0 drivers/hid/hid-core.c:1980
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1436
usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5866 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5948
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff8880222d53c0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes inside of
allocated 7-byte region [ffff8880222d53c0, ffff8880222d53c7)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222d5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b841500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2690993754, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_node_track_caller_noprof+0x2ee/0x510 mm/slub.c:4347
__kmemdup_nul mm/util.c:63 [inline]
kstrdup+0x53/0x100 mm/util.c:83
kstrdup_const+0x63/0x80 mm/util.c:103
__kernfs_new_node+0x9b/0x8e0 fs/kernfs/dir.c:633
kernfs_new_node+0x13c/0x1e0 fs/kernfs/dir.c:713
kernfs_create_link+0xcc/0x240 fs/kernfs/symlink.c:39
sysfs_do_create_link_sd+0x90/0x140 fs/sysfs/symlink.c:44
sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
sysfs_create_link+0x61/0xc0 fs/sysfs/symlink.c:92
device_add_class_symlinks drivers/base/core.c:3451 [inline]
device_add+0x62c/0x1a70 drivers/base/core.c:3643
page_owner free stack trace missing
Memory state around the buggy address:
ffff8880222d5280: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff8880222d5300: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff8880222d5380: fa fc fc fc 00 fc fc fc 07 fc fc fc 00 fc fc fc
^
ffff8880222d5400: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
ffff8880222d5480: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
==================================================================
Tested on:
commit: d7b8f8e2 Linux 6.16-rc5
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=10c82bd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1553428c580000
next prev parent reply other threads:[~2025-07-07 18:41 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-07 11:40 [syzbot] [usb?] KASAN: slab-out-of-bounds Read in mon_copy_to_buff syzbot
2025-07-07 15:05 ` syzbot
2025-07-07 18:09 ` Alan Stern
2025-07-07 18:41 ` syzbot [this message]
2025-07-07 19:18 ` Alan Stern
2025-07-07 19:48 ` syzbot
2025-07-09 15:28 ` Alan Stern
2025-07-09 15:56 ` syzbot
2025-07-09 17:52 ` Alan Stern
2025-07-09 18:29 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=686c14c0.a00a0220.6237c.0000.GAE@google.com \
--to=syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com \
--cc=contact@arnaud-lcm.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=manas18244@iiitd.ac.in \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.