Re: [syzbot] [usb?] KASAN: slab-out-of-bounds Read in mon_copy_to_buff

Alan Stern
2025-07-07T19:18:13Z

On Mon, Jul 07, 2025 at 11:41:04AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: slab-out-of-bounds Read in mon_copy_to_buff
>
> microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
> microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
> usbhid 1-1:0.0: count 0 reportnum 0 buf[0] 0

Aha! As I expected.

> ==================================================================
> BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
> Read of size 3904 at addr ffff8880222d53c1 by task kworker/1:2/3689

Let's see if this fixes it.

Alan Stern

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ d7b8f8e20813

drivers/hid/usbhid/hid-core.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)

Index: usb-devel/drivers/hid/usbhid/hid-core.c
===================================================================
--- usb-devel.orig/drivers/hid/usbhid/hid-core.c
+++ usb-devel/drivers/hid/usbhid/hid-core.c
@@ -911,14 +911,13 @@ static int usbhid_set_raw_report(struct
struct usb_host_interface *interface = intf->cur_altsetting;
int ret, skipped_report_id = 0;

- /* Byte 0 is the report number. Report data starts at byte 1.*/
- if ((rtype == HID_OUTPUT_REPORT) &&
- (hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID))
- buf[0] = 0;
- else
- buf[0] = reportnum;
-
- if (buf[0] == 0x0) {
+ /*
+ * If the report ID number is 0 then report data starts at byte 0.
+ * Otherwise byte 0 is the report number and report data starts
+ * at byte 1.
+ */
+ if (rtype == HID_OUTPUT_REPORT && reportnum > 0 &&
+ (hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID)) {
/* Don't send the Report ID */
buf++;
count--;