* [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
@ 2023-10-16 17:01 syzbot
2023-11-17 14:23 ` [syzbot] Test syzbot
` (5 more replies)
0 siblings, 6 replies; 14+ messages in thread
From: syzbot @ 2023-10-16 17:01 UTC (permalink / raw)
To: benjamin.tissoires, jikos, linux-input, linux-kernel, linux-usb,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ad7f1baed071 Merge tag 'acpi-6.6-rc6' of git://git.kernel...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1056d5c5680000
kernel config: https://syzkaller.appspot.com/x/.config?x=32d0b9b42ceb8b10
dashboard link: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1081f1e5680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c7bc4d680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e3074ad3ff92/disk-ad7f1bae.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94b298a1e285/vmlinux-ad7f1bae.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1ad5cd9c2a48/bzImage-ad7f1bae.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
usb 1-1: string descriptor 0 read error: -22
usb 1-1: New USB device found, idVendor=080e, idProduct=4eb9, bcdDevice=d7.f6
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
================================================================================
UBSAN: array-index-out-of-bounds in drivers/hid/usbhid/hid-core.c:1024:18
index 1 is out of range for type 'hid_class_descriptor [1]'
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.6.0-rc5-syzkaller-00227-gad7f1baed071 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:348
usbhid_parse+0x94a/0xa20 drivers/hid/usbhid/hid-core.c:1024
hid_add_device+0x189/0xa60 drivers/hid/hid-core.c:2783
usbhid_probe+0xd0a/0x1360 drivers/hid/usbhid/hid-core.c:1429
usb_probe_interface+0x307/0x930 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3624
usb_set_configuration+0x10cb/0x1c40 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0xca/0x130 drivers/usb/core/generic.c:238
usb_probe_device+0xda/0x2c0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3624
usb_new_device+0xd80/0x1960 drivers/usb/core/hub.c:2589
hub_port_connect drivers/usb/core/hub.c:5440 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5580 [inline]
port_event drivers/usb/core/hub.c:5740 [inline]
hub_event+0x2daf/0x4e00 drivers/usb/core/hub.c:5822
process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
kthread+0x33c/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
</TASK>
================================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] Test
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
@ 2023-11-17 14:23 ` syzbot
2023-11-21 19:19 ` [syzbot] [PATCH] Tried to correct syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2023-11-17 14:23 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Test
Author: tintinm2017@gmail.com
#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [PATCH] Tried to correct
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
2023-11-17 14:23 ` [syzbot] Test syzbot
@ 2023-11-21 19:19 ` syzbot
2023-11-22 8:08 ` kernel test robot
2023-12-23 19:59 ` [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning syzbot
` (3 subsequent siblings)
5 siblings, 1 reply; 14+ messages in thread
From: syzbot @ 2023-11-21 19:19 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] Tried to correct
Author: tintinm2017@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Signed-off-by: attreyee-muk <tintinm2017@gmail.com>
---
drivers/hid/usbhid/hid-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index a90ed2ceae84..582ddbef448f 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1021,6 +1021,8 @@ static int usbhid_parse(struct hid_device *hid)
(hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
for (n = 0; n < num_descriptors; n++)
+ if (n >= ARRAY_SIZE(hdesc->desc))
+ break;
if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH] Tried to correct
2023-11-21 19:19 ` [syzbot] [PATCH] Tried to correct syzbot
@ 2023-11-22 8:08 ` kernel test robot
0 siblings, 0 replies; 14+ messages in thread
From: kernel test robot @ 2023-11-22 8:08 UTC (permalink / raw)
To: syzbot, linux-kernel; +Cc: llvm, oe-kbuild-all
Hi syzbot,
kernel test robot noticed the following build warnings:
[auto build test WARNING on hid/for-next]
[also build test WARNING on linus/master v6.7-rc2 next-20231122]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/syzbot/Tried-to-correct/20231122-032130
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/000000000000c0be0d060aae7c5b%40google.com
patch subject: [PATCH] Tried to correct
config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20231122/202311221446.bQ7tsWmE-lkp@intel.com/config)
compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231122/202311221446.bQ7tsWmE-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202311221446.bQ7tsWmE-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/hid/usbhid/hid-core.c:1026:3: warning: misleading indentation; statement is not part of the previous 'for' [-Wmisleading-indentation]
if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
^
drivers/hid/usbhid/hid-core.c:1023:2: note: previous statement is here
for (n = 0; n < num_descriptors; n++)
^
1 warning generated.
vim +/for +1026 drivers/hid/usbhid/hid-core.c
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 978
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 979 static int usbhid_parse(struct hid_device *hid)
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 980 {
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 981 struct usb_interface *intf = to_usb_interface(hid->dev.parent);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 982 struct usb_host_interface *interface = intf->cur_altsetting;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 983 struct usb_device *dev = interface_to_usbdev (intf);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 984 struct hid_descriptor *hdesc;
2eb5dc30eb87aa drivers/hid/usbhid/hid-core.c Paul Walmsley 2007-04-19 985 u32 quirks = 0;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 986 unsigned int rsize = 0;
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 987 char *rdesc;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 988 int ret, n;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 989 int num_descriptors;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 990 size_t offset = offsetof(struct hid_descriptor, desc);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 991
d5d3e202753cc0 drivers/hid/usbhid/hid-core.c Benjamin Tissoires 2017-11-20 992 quirks = hid_lookup_quirk(hid);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 993
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 994 if (quirks & HID_QUIRK_IGNORE)
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 995 return -ENODEV;
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 996
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 997 /* Many keyboards and mice don't like to be polled for reports,
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 998 * so we will always set the HID_QUIRK_NOGET flag for them. */
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 999 if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1000 if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1001 interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1002 quirks |= HID_QUIRK_NOGET;
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1003 }
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1004
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1005 if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1006 (!interface->desc.bNumEndpoints ||
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1007 usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1008 dbg_hid("class descriptor not present\n");
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1009 return -ENODEV;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1010 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1011
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1012 if (hdesc->bLength < sizeof(struct hid_descriptor)) {
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1013 dbg_hid("hid descriptor is too short\n");
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1014 return -EINVAL;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1015 }
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1016
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1017 hid->version = le16_to_cpu(hdesc->bcdHID);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1018 hid->country = hdesc->bCountryCode;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1019
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1020 num_descriptors = min_t(int, hdesc->bNumDescriptors,
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1021 (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1022
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1023 for (n = 0; n < num_descriptors; n++)
6d33ae790f1855 drivers/hid/usbhid/hid-core.c syzbot 2023-11-21 1024 if (n >= ARRAY_SIZE(hdesc->desc))
6d33ae790f1855 drivers/hid/usbhid/hid-core.c syzbot 2023-11-21 1025 break;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 @1026 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1027 rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1028
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1029 if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1030 dbg_hid("weird size of report descriptor (%u)\n", rsize);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1031 return -EINVAL;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1032 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1033
52150c78270db5 drivers/hid/usbhid/hid-core.c Joe Perches 2017-03-01 1034 rdesc = kmalloc(rsize, GFP_KERNEL);
52150c78270db5 drivers/hid/usbhid/hid-core.c Joe Perches 2017-03-01 1035 if (!rdesc)
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1036 return -ENOMEM;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1037
854561b019285a drivers/usb/input/hid-core.c Vojtech Pavlik 2005-05-29 1038 hid_set_idle(dev, interface->desc.bInterfaceNumber, 0, 0);
854561b019285a drivers/usb/input/hid-core.c Vojtech Pavlik 2005-05-29 1039
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1040 ret = hid_get_class_descriptor(dev, interface->desc.bInterfaceNumber,
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1041 HID_DT_REPORT, rdesc, rsize);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1042 if (ret < 0) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1043 dbg_hid("reading report descriptor failed\n");
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1044 kfree(rdesc);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1045 goto err;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1046 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1047
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1048 ret = hid_parse_report(hid, rdesc, rsize);
85cdaf524b7dda drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1049 kfree(rdesc);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1050 if (ret) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1051 dbg_hid("parsing report descriptor failed\n");
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1052 goto err;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1053 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1054
f5208997087e6e drivers/hid/usbhid/hid-core.c Zoltan Karcagi 2009-05-06 1055 hid->quirks |= quirks;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1056
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1057 return 0;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1058 err:
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1059 return ret;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1060 }
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1061
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
2023-11-17 14:23 ` [syzbot] Test syzbot
2023-11-21 19:19 ` [syzbot] [PATCH] Tried to correct syzbot
@ 2023-12-23 19:59 ` syzbot
2024-01-03 14:12 ` Dan Carpenter
2024-03-05 18:55 ` [syzbot] " Kees Cook
2024-05-23 14:17 ` [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse Nikita Zhandarovich
` (2 subsequent siblings)
5 siblings, 2 replies; 14+ messages in thread
From: syzbot @ 2023-12-23 19:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
Author: tintinm2017@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Look at the bug https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495 reported by syzbot. Tested a patch through syzbot, which gives an error.
Requesting help from the maintainers to understand what is really going wrong in the code.
Based on my understanding, I believe the value of the number of descriptors is calculated incorrectly before the for loop.
Signed-off-by: Attreyee Mukherjee <tintinm2017@gmail.com>
---
drivers/hid/usbhid/hid-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index a90ed2ceae84..582ddbef448f 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1021,6 +1021,8 @@ static int usbhid_parse(struct hid_device *hid)
(hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
for (n = 0; n < num_descriptors; n++)
+ if (n >= ARRAY_SIZE(hdesc->desc))
+ break;
if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
2023-12-23 19:59 ` [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning syzbot
@ 2024-01-03 14:12 ` Dan Carpenter
2024-01-03 14:29 ` Aleksandr Nogikh
2024-03-05 18:55 ` [syzbot] " Kees Cook
1 sibling, 1 reply; 14+ messages in thread
From: Dan Carpenter @ 2024-01-03 14:12 UTC (permalink / raw)
To: oe-kbuild, syzbot, linux-kernel, syzkaller-bugs; +Cc: lkp, oe-kbuild-all
Hi syzbot,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/syzbot/usbhid-fix-array-index-out-of-bounds-in-usbhid_parse-UBSAN-warning/20231225-153341
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/0000000000009ae37b060d32c643%40google.com
patch subject: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
config: x86_64-randconfig-161-20231225 (https://download.01.org/0day-ci/archive/20231226/202312260900.gRDPofL9-lkp@intel.com/config)
compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202312260900.gRDPofL9-lkp@intel.com/
smatch warnings:
drivers/hid/usbhid/hid-core.c:1026 usbhid_parse() warn: curly braces intended?
drivers/hid/usbhid/hid-core.c:1029 usbhid_parse() warn: inconsistent indenting
vim +1026 drivers/hid/usbhid/hid-core.c
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 979 static int usbhid_parse(struct hid_device *hid)
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 980 {
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 981 struct usb_interface *intf = to_usb_interface(hid->dev.parent);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 982 struct usb_host_interface *interface = intf->cur_altsetting;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 983 struct usb_device *dev = interface_to_usbdev (intf);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 984 struct hid_descriptor *hdesc;
2eb5dc30eb87aa drivers/hid/usbhid/hid-core.c Paul Walmsley 2007-04-19 985 u32 quirks = 0;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 986 unsigned int rsize = 0;
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 987 char *rdesc;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 988 int ret, n;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 989 int num_descriptors;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 990 size_t offset = offsetof(struct hid_descriptor, desc);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 991
d5d3e202753cc0 drivers/hid/usbhid/hid-core.c Benjamin Tissoires 2017-11-20 992 quirks = hid_lookup_quirk(hid);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 993
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 994 if (quirks & HID_QUIRK_IGNORE)
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 995 return -ENODEV;
6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 996
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 997 /* Many keyboards and mice don't like to be polled for reports,
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 998 * so we will always set the HID_QUIRK_NOGET flag for them. */
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 999 if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1000 if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1001 interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1002 quirks |= HID_QUIRK_NOGET;
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1003 }
0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1004
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1005 if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1006 (!interface->desc.bNumEndpoints ||
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1007 usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1008 dbg_hid("class descriptor not present\n");
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1009 return -ENODEV;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1010 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1011
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1012 if (hdesc->bLength < sizeof(struct hid_descriptor)) {
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1013 dbg_hid("hid descriptor is too short\n");
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1014 return -EINVAL;
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1015 }
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1016
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1017 hid->version = le16_to_cpu(hdesc->bcdHID);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1018 hid->country = hdesc->bCountryCode;
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1019
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1020 num_descriptors = min_t(int, hdesc->bNumDescriptors,
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1021 (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1022
f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1023 for (n = 0; n < num_descriptors; n++)
This for loop needs curly braces now.
d3e0d5b253c73b drivers/hid/usbhid/hid-core.c syzbot 2023-12-23 1024 if (n >= ARRAY_SIZE(hdesc->desc))
d3e0d5b253c73b drivers/hid/usbhid/hid-core.c syzbot 2023-12-23 1025 break;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 @1026 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1027 rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1028
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 @1029 if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1030 dbg_hid("weird size of report descriptor (%u)\n", rsize);
c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1031 return -EINVAL;
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1032 }
^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1033
52150c78270db5 drivers/hid/usbhid/hid-core.c Joe Perches 2017-03-01 1034 rdesc = kmalloc(rsize, GFP_KERNEL);
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
2024-01-03 14:12 ` Dan Carpenter
@ 2024-01-03 14:29 ` Aleksandr Nogikh
0 siblings, 0 replies; 14+ messages in thread
From: Aleksandr Nogikh @ 2024-01-03 14:29 UTC (permalink / raw)
To: Dan Carpenter
Cc: oe-kbuild, syzbot, linux-kernel, syzkaller-bugs, lkp,
oe-kbuild-all
Hi Dan,
In this particular case syzbot just forwarded a user's patch testing
request to the LKML. I think there's not much value in kernel test
robot analyzing such emails.
--
Aleksandr
On Wed, Jan 3, 2024 at 3:12 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> Hi syzbot,
>
> kernel test robot noticed the following build warnings:
>
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url: https://github.com/intel-lab-lkp/linux/commits/syzbot/usbhid-fix-array-index-out-of-bounds-in-usbhid_parse-UBSAN-warning/20231225-153341
> base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
> patch link: https://lore.kernel.org/r/0000000000009ae37b060d32c643%40google.com
> patch subject: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
> config: x86_64-randconfig-161-20231225 (https://download.01.org/0day-ci/archive/20231226/202312260900.gRDPofL9-lkp@intel.com/config)
> compiler: clang version 16.0.4 (https://github.com/llvm/llvm-project.git ae42196bc493ffe877a7e3dff8be32035dea4d07)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> | Closes: https://lore.kernel.org/r/202312260900.gRDPofL9-lkp@intel.com/
>
> smatch warnings:
> drivers/hid/usbhid/hid-core.c:1026 usbhid_parse() warn: curly braces intended?
> drivers/hid/usbhid/hid-core.c:1029 usbhid_parse() warn: inconsistent indenting
>
> vim +1026 drivers/hid/usbhid/hid-core.c
>
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 979 static int usbhid_parse(struct hid_device *hid)
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 980 {
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 981 struct usb_interface *intf = to_usb_interface(hid->dev.parent);
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 982 struct usb_host_interface *interface = intf->cur_altsetting;
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 983 struct usb_device *dev = interface_to_usbdev (intf);
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 984 struct hid_descriptor *hdesc;
> 2eb5dc30eb87aa drivers/hid/usbhid/hid-core.c Paul Walmsley 2007-04-19 985 u32 quirks = 0;
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 986 unsigned int rsize = 0;
> c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 987 char *rdesc;
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 988 int ret, n;
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 989 int num_descriptors;
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 990 size_t offset = offsetof(struct hid_descriptor, desc);
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 991
> d5d3e202753cc0 drivers/hid/usbhid/hid-core.c Benjamin Tissoires 2017-11-20 992 quirks = hid_lookup_quirk(hid);
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 993
> 6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 994 if (quirks & HID_QUIRK_IGNORE)
> 6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 995 return -ENODEV;
> 6f4303fb2ec680 drivers/hid/usbhid/hid-core.c Jiri Kosina 2009-01-29 996
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 997 /* Many keyboards and mice don't like to be polled for reports,
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 998 * so we will always set the HID_QUIRK_NOGET flag for them. */
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 999 if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1000 if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1001 interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1002 quirks |= HID_QUIRK_NOGET;
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1003 }
> 0f28b55db54300 drivers/usb/input/hid-core.c Alan Stern 2006-05-15 1004
> c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1005 if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
> c5b7c7c395a34f drivers/usb/input/hid-core.c Dmitry Torokhov 2005-09-15 1006 (!interface->desc.bNumEndpoints ||
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1007 usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
> 58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1008 dbg_hid("class descriptor not present\n");
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1009 return -ENODEV;
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1010 }
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1011
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1012 if (hdesc->bLength < sizeof(struct hid_descriptor)) {
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1013 dbg_hid("hid descriptor is too short\n");
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1014 return -EINVAL;
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1015 }
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1016
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1017 hid->version = le16_to_cpu(hdesc->bcdHID);
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1018 hid->country = hdesc->bCountryCode;
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1019
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1020 num_descriptors = min_t(int, hdesc->bNumDescriptors,
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1021 (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1022
> f043bfc98c193c drivers/hid/usbhid/hid-core.c Jaejoong Kim 2017-09-28 1023 for (n = 0; n < num_descriptors; n++)
>
> This for loop needs curly braces now.
>
> d3e0d5b253c73b drivers/hid/usbhid/hid-core.c syzbot 2023-12-23 1024 if (n >= ARRAY_SIZE(hdesc->desc))
> d3e0d5b253c73b drivers/hid/usbhid/hid-core.c syzbot 2023-12-23 1025 break;
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 @1026 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1027 rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1028
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 @1029 if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
> 58037eb961f859 drivers/hid/usbhid/hid-core.c Jiri Kosina 2007-05-30 1030 dbg_hid("weird size of report descriptor (%u)\n", rsize);
> c500c9714011ed drivers/hid/usbhid/hid-core.c Jiri Slaby 2008-05-16 1031 return -EINVAL;
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1032 }
> ^1da177e4c3f41 drivers/usb/input/hid-core.c Linus Torvalds 2005-04-16 1033
> 52150c78270db5 drivers/hid/usbhid/hid-core.c Joe Perches 2017-03-01 1034 rdesc = kmalloc(rsize, GFP_KERNEL);
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/5e68be46-caab-40f4-8e0f-543566fd7c28%40moroto.mountain.
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
2023-12-23 19:59 ` [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning syzbot
2024-01-03 14:12 ` Dan Carpenter
@ 2024-03-05 18:55 ` Kees Cook
1 sibling, 0 replies; 14+ messages in thread
From: Kees Cook @ 2024-03-05 18:55 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires, Attreyee Mukherjee
Cc: linux-kernel, syzkaller-bugs, syzbot, linux-usb, linux-hardening
Hi,
What's happened to getting a new version of this patch? This flaw is
still reachable in -next from what I can see?
Thanks,
-Kees
On Sat, Dec 23, 2023 at 11:59:51AM -0800, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
>
> ***
>
> Subject: [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning
> Author: tintinm2017@gmail.com
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>
> Look at the bug https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495 reported by syzbot. Tested a patch through syzbot, which gives an error.
> Requesting help from the maintainers to understand what is really going wrong in the code.
>
> Based on my understanding, I believe the value of the number of descriptors is calculated incorrectly before the for loop.
>
> Signed-off-by: Attreyee Mukherjee <tintinm2017@gmail.com>
> ---
> drivers/hid/usbhid/hid-core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
> index a90ed2ceae84..582ddbef448f 100644
> --- a/drivers/hid/usbhid/hid-core.c
> +++ b/drivers/hid/usbhid/hid-core.c
> @@ -1021,6 +1021,8 @@ static int usbhid_parse(struct hid_device *hid)
> (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
>
> for (n = 0; n < num_descriptors; n++)
> + if (n >= ARRAY_SIZE(hdesc->desc))
> + break;
> if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
> rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
>
> --
> 2.34.1
>
--
Kees Cook
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
` (2 preceding siblings ...)
2023-12-23 19:59 ` [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning syzbot
@ 2024-05-23 14:17 ` Nikita Zhandarovich
2024-05-24 1:56 ` syzbot
2025-01-30 10:20 ` Nikita Zhandarovich
2025-01-31 7:13 ` Nikita Zhandarovich
5 siblings, 1 reply; 14+ messages in thread
From: Nikita Zhandarovich @ 2024-05-23 14:17 UTC (permalink / raw)
To: syzbot+c52569baf0c843f35495
Cc: Nikita Zhandarovich, syzkaller-bugs, linux-kernel
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/hid/usbhid/hid-core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index a90ed2ceae84..f38a4bd3a20e 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1020,6 +1020,9 @@ static int usbhid_parse(struct hid_device *hid)
num_descriptors = min_t(int, hdesc->bNumDescriptors,
(hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
+ if (num_descriptors > ARRAY_SIZE(hdesc->desc))
+ num_descriptors = ARRAY_SIZE(hdesc->desc);
+
for (n = 0; n < num_descriptors; n++)
if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2024-05-23 14:17 ` [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse Nikita Zhandarovich
@ 2024-05-24 1:56 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2024-05-24 1:56 UTC (permalink / raw)
To: linux-kernel, n.zhandarovich, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
Tested on:
commit: b4d88a60 Merge tag 'block-6.10-20240523' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=117100d8980000
kernel config: https://syzkaller.appspot.com/x/.config?x=34e05c35ec964e75
dashboard link: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1293b80c980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
` (3 preceding siblings ...)
2024-05-23 14:17 ` [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse Nikita Zhandarovich
@ 2025-01-30 10:20 ` Nikita Zhandarovich
2025-01-30 14:14 ` syzbot
2025-01-31 7:13 ` Nikita Zhandarovich
5 siblings, 1 reply; 14+ messages in thread
From: Nikita Zhandarovich @ 2025-01-30 10:20 UTC (permalink / raw)
To: syzbot; +Cc: Nikita Zhandarovich, syzkaller-bugs, linux-kernel
Test to see that changes made to hid_descriptor are fine.
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/hid/usbhid/hid-core.c | 2 +-
drivers/usb/gadget/function/f_fs.c | 3 ++-
drivers/usb/gadget/function/f_hid.c | 22 ++++++++++++++--------
include/linux/hid.h | 2 +-
4 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index a6eb6fe6130d..eb4807785d6d 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1010,7 +1010,7 @@ static int usbhid_parse(struct hid_device *hid)
return -ENODEV;
}
- if (hdesc->bLength < sizeof(struct hid_descriptor)) {
+ if (hdesc->bLength < struct_size(hdesc, desc, hdesc->bNumDescriptors)) {
dbg_hid("hid descriptor is too short\n");
return -EINVAL;
}
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 2dea9e42a0f8..a4b6d7cbf56d 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2550,7 +2550,8 @@ static int __must_check ffs_do_single_desc(char *data, unsigned len,
case USB_TYPE_CLASS | 0x01:
if (*current_class == USB_INTERFACE_CLASS_HID) {
pr_vdebug("hid descriptor\n");
- if (length != sizeof(struct hid_descriptor))
+ if (length < sizeof(struct hid_descriptor) +
+ sizeof(struct hid_class_descriptor))
goto inv_length;
break;
} else if (*current_class == USB_INTERFACE_CLASS_CCID) {
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 740311c4fa24..ec8c2e2d6812 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -139,13 +139,17 @@ static struct usb_interface_descriptor hidg_interface_desc = {
};
static struct hid_descriptor hidg_desc = {
- .bLength = sizeof hidg_desc,
+ .bLength = struct_size(&hidg_desc, desc, 1),
.bDescriptorType = HID_DT_HID,
.bcdHID = cpu_to_le16(0x0101),
.bCountryCode = 0x00,
.bNumDescriptors = 0x1,
- /*.desc[0].bDescriptorType = DYNAMIC */
- /*.desc[0].wDescriptorLenght = DYNAMIC */
+ .desc = {
+ {
+ .bDescriptorType = 0, /* DYNAMIC */
+ .wDescriptorLength = 0, /* DYNAMIC */
+ }
+ }
};
/* Super-Speed Support */
@@ -936,16 +940,18 @@ static int hidg_setup(struct usb_function *f,
switch (value >> 8) {
case HID_DT_HID:
{
- struct hid_descriptor hidg_desc_copy = hidg_desc;
+ DEFINE_FLEX(struct hid_descriptor, hidg_desc_copy,
+ desc, bNumDescriptors, 1);
+ *hidg_desc_copy = hidg_desc;
VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n");
- hidg_desc_copy.desc[0].bDescriptorType = HID_DT_REPORT;
- hidg_desc_copy.desc[0].wDescriptorLength =
+ hidg_desc_copy->desc[0].bDescriptorType = HID_DT_REPORT;
+ hidg_desc_copy->desc[0].wDescriptorLength =
cpu_to_le16(hidg->report_desc_length);
length = min_t(unsigned short, length,
- hidg_desc_copy.bLength);
- memcpy(req->buf, &hidg_desc_copy, length);
+ hidg_desc_copy->bLength);
+ memcpy(req->buf, hidg_desc_copy, length);
goto respond;
break;
}
diff --git a/include/linux/hid.h b/include/linux/hid.h
index cdc0dc13c87f..85a58ae2c4a0 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -739,7 +739,7 @@ struct hid_descriptor {
__u8 bCountryCode;
__u8 bNumDescriptors;
- struct hid_class_descriptor desc[1];
+ struct hid_class_descriptor desc[] __counted_by(bNumDescriptors);
} __attribute__ ((packed));
#define HID_DEVICE(b, g, ven, prod) \
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2025-01-30 10:20 ` Nikita Zhandarovich
@ 2025-01-30 14:14 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2025-01-30 14:14 UTC (permalink / raw)
To: linux-kernel, n.zhandarovich, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
61.124748][ T29] audit: type=1400 audit(1738246367.103:107): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.PSkP8X/syz-tmp" dev="sda1" ino=1933 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 61.149125][ T29] audit: type=1400 audit(1738246367.103:108): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 61.172056][ T29] audit: type=1400 audit(1738246367.103:109): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.PSkP8X/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 61.199012][ T29] audit: type=1400 audit(1738246367.103:110): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[ 61.220940][ T29] audit: type=1400 audit(1738246367.113:111): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.PSkP8X/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[ 61.226696][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 61.248122][ T29] audit: type=1400 audit(1738246367.113:112): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.PSkP8X/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[ 61.407846][ T5829] ==================================================================
[ 61.415938][ T5829] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0
[ 61.423696][ T5829] Write of size 8 at addr ffff888033ad8c08 by task syz-executor/5829
[ 61.431852][ T5829]
[ 61.434171][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz-executor Not tainted 6.13.0-syzkaller-09485-g72deda0abee6-dirty #0
[ 61.434185][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 61.434196][ T5829] Call Trace:
[ 61.434201][ T5829] <TASK>
[ 61.434206][ T5829] dump_stack_lvl+0x116/0x1f0
[ 61.434227][ T5829] print_report+0xc3/0x620
[ 61.434239][ T5829] ? __virt_addr_valid+0x5e/0x590
[ 61.434250][ T5829] ? __phys_addr+0xc6/0x150
[ 61.434261][ T5829] kasan_report+0xd9/0x110
[ 61.434271][ T5829] ? binder_add_device+0xa4/0xb0
[ 61.434284][ T5829] ? binder_add_device+0xa4/0xb0
[ 61.434296][ T5829] binder_add_device+0xa4/0xb0
[ 61.434308][ T5829] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 61.434325][ T5829] binderfs_fill_super+0x8d6/0x1360
[ 61.434341][ T5829] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.434360][ T5829] ? shrinker_register+0x1a8/0x260
[ 61.434375][ T5829] ? sget_fc+0x808/0xc20
[ 61.434390][ T5829] ? __pfx_set_anon_super_fc+0x10/0x10
[ 61.434405][ T5829] ? __pfx_binderfs_fill_super+0x10/0x10
[ 61.434418][ T5829] get_tree_nodev+0xda/0x190
[ 61.434433][ T5829] vfs_get_tree+0x8b/0x340
[ 61.434446][ T5829] path_mount+0x14e6/0x1f10
[ 61.434458][ T5829] ? kmem_cache_free+0x2e2/0x4d0
[ 61.434468][ T5829] ? __pfx_path_mount+0x10/0x10
[ 61.434479][ T5829] ? putname+0x13c/0x180
[ 61.434491][ T5829] __x64_sys_mount+0x28f/0x310
[ 61.434502][ T5829] ? __pfx___x64_sys_mount+0x10/0x10
[ 61.434514][ T5829] do_syscall_64+0xcd/0x250
[ 61.434528][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.434543][ T5829] RIP: 0033:0x7f92ed5816ba
[ 61.434553][ T5829] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 61.434566][ T5829] RSP: 002b:00007f92ed86ff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 61.434577][ T5829] RAX: ffffffffffffffda RBX: 00007f92ed5f3d49 RCX: 00007f92ed5816ba
[ 61.434584][ T5829] RDX: 00007f92ed5ff2fa RSI: 00007f92ed5f3d49 RDI: 00007f92ed5ff2fa
[ 61.434591][ T5829] RBP: 00007f92ed5f3f58 R08: 0000000000000000 R09: 0000000000000100
[ 61.434597][ T5829] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92ed5de068
[ 61.434603][ T5829] R13: 00007f92ed5de048 R14: 0000000000000009 R15: 0000000000000000
[ 61.434612][ T5829] </TASK>
[ 61.434616][ T5829]
[ 61.662253][ T5829] Allocated by task 5824:
[ 61.666566][ T5829] kasan_save_stack+0x33/0x60
[ 61.671232][ T5829] kasan_save_track+0x14/0x30
[ 61.675901][ T5829] __kasan_kmalloc+0xaa/0xb0
[ 61.680489][ T5829] binderfs_binder_device_create.isra.0+0x17a/0xb70
[ 61.687072][ T5829] binderfs_fill_super+0x8d6/0x1360
[ 61.692351][ T5829] get_tree_nodev+0xda/0x190
[ 61.697019][ T5829] vfs_get_tree+0x8b/0x340
[ 61.701427][ T5829] path_mount+0x14e6/0x1f10
[ 61.705952][ T5829] __x64_sys_mount+0x28f/0x310
[ 61.710702][ T5829] do_syscall_64+0xcd/0x250
[ 61.715192][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.721074][ T5829]
[ 61.723377][ T5829] Freed by task 5824:
[ 61.727338][ T5829] kasan_save_stack+0x33/0x60
[ 61.732087][ T5829] kasan_save_track+0x14/0x30
[ 61.736952][ T5829] kasan_save_free_info+0x3b/0x60
[ 61.741970][ T5829] __kasan_slab_free+0x51/0x70
[ 61.746718][ T5829] kfree+0x2c4/0x4d0
[ 61.750815][ T5829] binderfs_evict_inode+0x1e0/0x250
[ 61.756001][ T5829] evict+0x409/0x960
[ 61.759886][ T5829] iput+0x52a/0x890
[ 61.763678][ T5829] dentry_unlink_inode+0x29c/0x480
[ 61.768789][ T5829] __dentry_kill+0x1d0/0x600
[ 61.773365][ T5829] shrink_dentry_list+0x140/0x5d0
[ 61.778385][ T5829] shrink_dcache_parent+0xe2/0x530
[ 61.783483][ T5829] shrink_dcache_for_umount+0xa1/0x3e0
[ 61.788936][ T5829] generic_shutdown_super+0x6c/0x390
[ 61.794210][ T5829] kill_litter_super+0x70/0xa0
[ 61.798990][ T5829] binderfs_kill_super+0x3b/0xa0
[ 61.804029][ T5829] deactivate_locked_super+0xbe/0x1a0
[ 61.809396][ T5829] deactivate_super+0xde/0x100
[ 61.814448][ T5829] cleanup_mnt+0x222/0x450
[ 61.818866][ T5829] task_work_run+0x14e/0x250
[ 61.823450][ T5829] do_exit+0xad8/0x2d70
[ 61.827590][ T5829] do_group_exit+0xd3/0x2a0
[ 61.832085][ T5829] get_signal+0x24ed/0x26c0
[ 61.836576][ T5829] arch_do_signal_or_restart+0x90/0x7e0
[ 61.842192][ T5829] syscall_exit_to_user_mode+0x150/0x2a0
[ 61.847808][ T5829] do_syscall_64+0xda/0x250
[ 61.852298][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.858209][ T5829]
[ 61.860544][ T5829] The buggy address belongs to the object at ffff888033ad8c00
[ 61.860544][ T5829] which belongs to the cache kmalloc-512 of size 512
[ 61.874601][ T5829] The buggy address is located 8 bytes inside of
[ 61.874601][ T5829] freed 512-byte region [ffff888033ad8c00, ffff888033ad8e00)
[ 61.888229][ T5829]
[ 61.890535][ T5829] The buggy address belongs to the physical page:
[ 61.896943][ T5829] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33ad8
[ 61.905689][ T5829] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 61.914167][ T5829] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 61.921715][ T5829] page_type: f5(slab)
[ 61.925679][ T5829] raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 61.934259][ T5829] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 61.942830][ T5829] head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 61.951499][ T5829] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 61.960156][ T5829] head: 00fff00000000002 ffffea0000ceb601 ffffffffffffffff 0000000000000000
[ 61.968812][ T5829] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 61.977484][ T5829] page dumped because: kasan: bad access detected
[ 61.983891][ T5829] page_owner tracks the page as allocated
[ 61.989672][ T5829] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5204, tgid 5204 (udevd), ts 20443550863, free_ts 19532985486
[ 62.010416][ T5829] post_alloc_hook+0x181/0x1b0
[ 62.015177][ T5829] get_page_from_freelist+0xfce/0x2f80
[ 62.020624][ T5829] __alloc_frozen_pages_noprof+0x221/0x2470
[ 62.026501][ T5829] alloc_pages_mpol+0x1fc/0x540
[ 62.031336][ T5829] new_slab+0x23d/0x330
[ 62.035480][ T5829] ___slab_alloc+0xc5d/0x1720
[ 62.040177][ T5829] __slab_alloc.constprop.0+0x56/0xb0
[ 62.045542][ T5829] __kmalloc_cache_noprof+0xfa/0x410
[ 62.050830][ T5829] kernfs_fop_open+0x28b/0xdb0
[ 62.055588][ T5829] do_dentry_open+0x735/0x1c40
[ 62.060366][ T5829] vfs_open+0x82/0x3f0
[ 62.064419][ T5829] path_openat+0x1e88/0x2d80
[ 62.068988][ T5829] do_filp_open+0x20c/0x470
[ 62.073484][ T5829] do_sys_openat2+0x17a/0x1e0
[ 62.078160][ T5829] __x64_sys_openat+0x175/0x210
[ 62.082997][ T5829] do_syscall_64+0xcd/0x250
[ 62.087498][ T5829] page last free pid 5205 tgid 5205 stack trace:
[ 62.093813][ T5829] free_frozen_pages+0x6db/0xfb0
[ 62.098734][ T5829] rcu_core+0x79d/0x14d0
[ 62.102960][ T5829] handle_softirqs+0x213/0x8f0
[ 62.107713][ T5829] __irq_exit_rcu+0x109/0x170
[ 62.112387][ T5829] irq_exit_rcu+0x9/0x30
[ 62.116624][ T5829] sysvec_apic_timer_interrupt+0xa4/0xc0
[ 62.122243][ T5829] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 62.128212][ T5829]
[ 62.130521][ T5829] Memory state around the buggy address:
[ 62.136131][ T5829] ffff888033ad8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.144174][ T5829] ffff888033ad8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 62.152216][ T5829] >ffff888033ad8c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.160266][ T5829] ^
[ 62.164578][ T5829] ffff888033ad8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.172621][ T5829] ffff888033ad8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.180658][ T5829] ==================================================================
[ 62.199606][ T5829] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 62.206872][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz-executor Not tainted 6.13.0-syzkaller-09485-g72deda0abee6-dirty #0
[ 62.217884][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 62.227922][ T5829] Call Trace:
[ 62.231187][ T5829] <TASK>
[ 62.234103][ T5829] dump_stack_lvl+0x3d/0x1f0
[ 62.238731][ T5829] panic+0x71d/0x800
[ 62.242615][ T5829] ? __pfx_panic+0x10/0x10
[ 62.247018][ T5829] ? irqentry_exit+0x3b/0x90
[ 62.251593][ T5829] ? lockdep_hardirqs_on+0x7c/0x110
[ 62.256789][ T5829] ? preempt_schedule_thunk+0x1a/0x30
[ 62.262169][ T5829] ? preempt_schedule_common+0x44/0xc0
[ 62.267619][ T5829] ? check_panic_on_warn+0x1f/0xb0
[ 62.272717][ T5829] check_panic_on_warn+0xab/0xb0
[ 62.277728][ T5829] end_report+0x117/0x180
[ 62.282070][ T5829] kasan_report+0xe9/0x110
[ 62.286521][ T5829] ? binder_add_device+0xa4/0xb0
[ 62.291449][ T5829] ? binder_add_device+0xa4/0xb0
[ 62.296389][ T5829] binder_add_device+0xa4/0xb0
[ 62.301141][ T5829] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 62.307722][ T5829] binderfs_fill_super+0x8d6/0x1360
[ 62.313001][ T5829] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.318631][ T5829] ? shrinker_register+0x1a8/0x260
[ 62.323733][ T5829] ? sget_fc+0x808/0xc20
[ 62.327964][ T5829] ? __pfx_set_anon_super_fc+0x10/0x10
[ 62.333409][ T5829] ? __pfx_binderfs_fill_super+0x10/0x10
[ 62.339029][ T5829] get_tree_nodev+0xda/0x190
[ 62.343610][ T5829] vfs_get_tree+0x8b/0x340
[ 62.348123][ T5829] path_mount+0x14e6/0x1f10
[ 62.352612][ T5829] ? kmem_cache_free+0x2e2/0x4d0
[ 62.357536][ T5829] ? __pfx_path_mount+0x10/0x10
[ 62.362372][ T5829] ? putname+0x13c/0x180
[ 62.366603][ T5829] __x64_sys_mount+0x28f/0x310
[ 62.371360][ T5829] ? __pfx___x64_sys_mount+0x10/0x10
[ 62.376630][ T5829] do_syscall_64+0xcd/0x250
[ 62.381121][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.387019][ T5829] RIP: 0033:0x7f92ed5816ba
[ 62.391443][ T5829] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 62.411242][ T5829] RSP: 002b:00007f92ed86ff68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 62.419651][ T5829] RAX: ffffffffffffffda RBX: 00007f92ed5f3d49 RCX: 00007f92ed5816ba
[ 62.427605][ T5829] RDX: 00007f92ed5ff2fa RSI: 00007f92ed5f3d49 RDI: 00007f92ed5ff2fa
[ 62.435561][ T5829] RBP: 00007f92ed5f3f58 R08: 0000000000000000 R09: 0000000000000100
[ 62.443515][ T5829] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92ed5de068
[ 62.451492][ T5829] R13: 00007f92ed5de048 R14: 0000000000000009 R15: 0000000000000000
[ 62.459483][ T5829] </TASK>
[ 62.462725][ T5829] Kernel Offset: disabled
[ 62.467031][ T5829] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3526199464=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at b50eb251af
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=b50eb251af3b122fb1b2c574dde0c3d16f6a8cfd -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241203-163055'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"b50eb251af3b122fb1b2c574dde0c3d16f6a8cfd\"
/usr/bin/ld: /tmp/ccVS4jTw.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=10b9a324580000
Tested on:
commit: 72deda0a Merge tag 'soundwire-6.14-rc1' of git://git.k..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=d1d4677fc8e45064
dashboard link: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10fa0b64580000
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
` (4 preceding siblings ...)
2025-01-30 10:20 ` Nikita Zhandarovich
@ 2025-01-31 7:13 ` Nikita Zhandarovich
2025-01-31 7:39 ` syzbot
5 siblings, 1 reply; 14+ messages in thread
From: Nikita Zhandarovich @ 2025-01-31 7:13 UTC (permalink / raw)
To: syzbot; +Cc: Nikita Zhandarovich, syzkaller-bugs, linux-kernel
Test if upstream is broken.
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse
2025-01-31 7:13 ` Nikita Zhandarovich
@ 2025-01-31 7:39 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2025-01-31 7:39 UTC (permalink / raw)
To: linux-kernel, n.zhandarovich, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[ 63.252248][ T29] audit: type=1400 audit(1738309108.737:112): avc: denied { mounton } for pid=5825 comm="syz-executor" path="/root/syzkaller.4uglaD/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4883 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[ 63.279716][ T29] audit: type=1400 audit(1738309108.737:113): avc: denied { unmount } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 63.299322][ T29] audit: type=1400 audit(1738309108.757:114): avc: denied { mounton } for pid=5825 comm="syz-executor" path="/dev/binderfs" dev="devtmpfs" ino=2723 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[ 63.322245][ T29] audit: type=1400 audit(1738309108.757:115): avc: denied { mount } for pid=5825 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[ 63.345302][ T29] audit: type=1400 audit(1738309108.757:116): avc: denied { mounton } for pid=5825 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[ 63.349349][ T5825] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 63.601832][ T5830] ==================================================================
[ 63.609917][ T5830] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0
[ 63.617631][ T5830] Write of size 8 at addr ffff888033fc6c08 by task syz-executor/5830
[ 63.625684][ T5830]
[ 63.628098][ T5830] CPU: 0 UID: 0 PID: 5830 Comm: syz-executor Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
[ 63.628112][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 63.628121][ T5830] Call Trace:
[ 63.628126][ T5830] <TASK>
[ 63.628134][ T5830] dump_stack_lvl+0x116/0x1f0
[ 63.628154][ T5830] print_report+0xc3/0x620
[ 63.628166][ T5830] ? __virt_addr_valid+0x5e/0x590
[ 63.628178][ T5830] ? __phys_addr+0xc6/0x150
[ 63.628188][ T5830] kasan_report+0xd9/0x110
[ 63.628198][ T5830] ? binder_add_device+0xa4/0xb0
[ 63.628212][ T5830] ? binder_add_device+0xa4/0xb0
[ 63.628226][ T5830] binder_add_device+0xa4/0xb0
[ 63.628238][ T5830] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 63.628255][ T5830] binderfs_fill_super+0x8d6/0x1360
[ 63.628271][ T5830] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.628290][ T5830] ? shrinker_register+0x1a8/0x260
[ 63.628305][ T5830] ? sget_fc+0x808/0xc20
[ 63.628320][ T5830] ? __pfx_set_anon_super_fc+0x10/0x10
[ 63.628335][ T5830] ? __pfx_binderfs_fill_super+0x10/0x10
[ 63.628349][ T5830] get_tree_nodev+0xda/0x190
[ 63.628364][ T5830] vfs_get_tree+0x8b/0x340
[ 63.628377][ T5830] path_mount+0x14e6/0x1f10
[ 63.628389][ T5830] ? kmem_cache_free+0x2e2/0x4d0
[ 63.628399][ T5830] ? __pfx_path_mount+0x10/0x10
[ 63.628410][ T5830] ? putname+0x13c/0x180
[ 63.628423][ T5830] __x64_sys_mount+0x28f/0x310
[ 63.628434][ T5830] ? __pfx___x64_sys_mount+0x10/0x10
[ 63.628446][ T5830] do_syscall_64+0xcd/0x250
[ 63.628461][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.628476][ T5830] RIP: 0033:0x7f5c0fd816ba
[ 63.628486][ T5830] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 63.628499][ T5830] RSP: 002b:00007ffc2db5bbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 63.628510][ T5830] RAX: ffffffffffffffda RBX: 00007f5c0fdf3d49 RCX: 00007f5c0fd816ba
[ 63.628517][ T5830] RDX: 00007f5c0fdff2fa RSI: 00007f5c0fdf3d49 RDI: 00007f5c0fdff2fa
[ 63.628524][ T5830] RBP: 00007f5c0fdf3f58 R08: 0000000000000000 R09: 00000000000001ff
[ 63.628531][ T5830] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c0fdde068
[ 63.628537][ T5830] R13: 00007f5c0fdde048 R14: 0000000000000009 R15: 0000000000000000
[ 63.628546][ T5830] </TASK>
[ 63.628550][ T5830]
[ 63.855639][ T5830] Allocated by task 5825:
[ 63.859939][ T5830] kasan_save_stack+0x33/0x60
[ 63.864593][ T5830] kasan_save_track+0x14/0x30
[ 63.869241][ T5830] __kasan_kmalloc+0xaa/0xb0
[ 63.873802][ T5830] binderfs_binder_device_create.isra.0+0x17a/0xb70
[ 63.880372][ T5830] binderfs_fill_super+0x8d6/0x1360
[ 63.885551][ T5830] get_tree_nodev+0xda/0x190
[ 63.890132][ T5830] vfs_get_tree+0x8b/0x340
[ 63.894529][ T5830] path_mount+0x14e6/0x1f10
[ 63.899013][ T5830] __x64_sys_mount+0x28f/0x310
[ 63.903753][ T5830] do_syscall_64+0xcd/0x250
[ 63.908236][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.914106][ T5830]
[ 63.916406][ T5830] Freed by task 5825:
[ 63.920358][ T5830] kasan_save_stack+0x33/0x60
[ 63.925013][ T5830] kasan_save_track+0x14/0x30
[ 63.929663][ T5830] kasan_save_free_info+0x3b/0x60
[ 63.934667][ T5830] __kasan_slab_free+0x51/0x70
[ 63.939409][ T5830] kfree+0x2c4/0x4d0
[ 63.943291][ T5830] binderfs_evict_inode+0x1e0/0x250
[ 63.948494][ T5830] evict+0x409/0x960
[ 63.952454][ T5830] iput+0x52a/0x890
[ 63.956240][ T5830] dentry_unlink_inode+0x29c/0x480
[ 63.961341][ T5830] __dentry_kill+0x1d0/0x600
[ 63.965923][ T5830] shrink_dentry_list+0x140/0x5d0
[ 63.970955][ T5830] shrink_dcache_parent+0xe2/0x530
[ 63.976049][ T5830] shrink_dcache_for_umount+0xa1/0x3e0
[ 63.981488][ T5830] generic_shutdown_super+0x6c/0x390
[ 63.986757][ T5830] kill_litter_super+0x70/0xa0
[ 63.991514][ T5830] binderfs_kill_super+0x3b/0xa0
[ 63.996437][ T5830] deactivate_locked_super+0xbe/0x1a0
[ 64.001818][ T5830] deactivate_super+0xde/0x100
[ 64.006607][ T5830] cleanup_mnt+0x222/0x450
[ 64.011006][ T5830] task_work_run+0x14e/0x250
[ 64.015574][ T5830] do_exit+0xad8/0x2d70
[ 64.019705][ T5830] do_group_exit+0xd3/0x2a0
[ 64.024189][ T5830] get_signal+0x24ed/0x26c0
[ 64.028671][ T5830] arch_do_signal_or_restart+0x90/0x7e0
[ 64.034189][ T5830] syscall_exit_to_user_mode+0x150/0x2a0
[ 64.039798][ T5830] do_syscall_64+0xda/0x250
[ 64.044368][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.050240][ T5830]
[ 64.052537][ T5830] The buggy address belongs to the object at ffff888033fc6c00
[ 64.052537][ T5830] which belongs to the cache kmalloc-512 of size 512
[ 64.066582][ T5830] The buggy address is located 8 bytes inside of
[ 64.066582][ T5830] freed 512-byte region [ffff888033fc6c00, ffff888033fc6e00)
[ 64.080181][ T5830]
[ 64.082483][ T5830] The buggy address belongs to the physical page:
[ 64.088873][ T5830] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33fc4
[ 64.097612][ T5830] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 64.106608][ T5830] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 64.114131][ T5830] page_type: f5(slab)
[ 64.118088][ T5830] raw: 00fff00000000040 ffff88801b041c80 ffffea0000d64600 dead000000000002
[ 64.126660][ T5830] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 64.135218][ T5830] head: 00fff00000000040 ffff88801b041c80 ffffea0000d64600 dead000000000002
[ 64.143878][ T5830] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 64.152610][ T5830] head: 00fff00000000002 ffffea0000cff101 ffffffffffffffff 0000000000000000
[ 64.161253][ T5830] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 64.169911][ T5830] page dumped because: kasan: bad access detected
[ 64.176303][ T5830] page_owner tracks the page as allocated
[ 64.182001][ T5830] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5204, tgid 5204 (udevd), ts 19812150758, free_ts 19804332293
[ 64.202759][ T5830] post_alloc_hook+0x181/0x1b0
[ 64.207510][ T5830] get_page_from_freelist+0xfce/0x2f80
[ 64.212945][ T5830] __alloc_frozen_pages_noprof+0x221/0x2470
[ 64.218837][ T5830] alloc_pages_mpol+0x1fc/0x540
[ 64.223678][ T5830] new_slab+0x23d/0x330
[ 64.227813][ T5830] ___slab_alloc+0xc5d/0x1720
[ 64.232469][ T5830] __slab_alloc.constprop.0+0x56/0xb0
[ 64.237817][ T5830] __kmalloc_cache_noprof+0xfa/0x410
[ 64.243092][ T5830] kernfs_fop_open+0x28b/0xdb0
[ 64.247841][ T5830] do_dentry_open+0x735/0x1c40
[ 64.252589][ T5830] vfs_open+0x82/0x3f0
[ 64.256632][ T5830] path_openat+0x1e88/0x2d80
[ 64.261192][ T5830] do_filp_open+0x20c/0x470
[ 64.265666][ T5830] do_sys_openat2+0x17a/0x1e0
[ 64.270318][ T5830] __x64_sys_openat+0x175/0x210
[ 64.275142][ T5830] do_syscall_64+0xcd/0x250
[ 64.279635][ T5830] page last free pid 5198 tgid 5198 stack trace:
[ 64.285933][ T5830] free_frozen_pages+0x6db/0xfb0
[ 64.290843][ T5830] qlist_free_all+0x4e/0x120
[ 64.295415][ T5830] kasan_quarantine_reduce+0x195/0x1e0
[ 64.300872][ T5830] __kasan_slab_alloc+0x69/0x90
[ 64.305697][ T5830] __kmalloc_node_noprof+0x1d0/0x510
[ 64.310962][ T5830] __kvmalloc_node_noprof+0xad/0x1a0
[ 64.316225][ T5830] seq_read_iter+0x82a/0x12b0
[ 64.320886][ T5830] kernfs_fop_read_iter+0x414/0x580
[ 64.326074][ T5830] vfs_read+0x886/0xbf0
[ 64.330216][ T5830] ksys_read+0x12b/0x250
[ 64.334453][ T5830] do_syscall_64+0xcd/0x250
[ 64.338943][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.344831][ T5830]
[ 64.347142][ T5830] Memory state around the buggy address:
[ 64.352755][ T5830] ffff888033fc6b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.360791][ T5830] ffff888033fc6b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.368826][ T5830] >ffff888033fc6c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 64.376859][ T5830] ^
[ 64.381176][ T5830] ffff888033fc6c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 64.389211][ T5830] ffff888033fc6d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 64.397245][ T5830] ==================================================================
[ 64.407234][ T5830] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 64.414448][ T5830] CPU: 0 UID: 0 PID: 5830 Comm: syz-executor Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
[ 64.424947][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 64.434979][ T5830] Call Trace:
[ 64.438234][ T5830] <TASK>
[ 64.441141][ T5830] dump_stack_lvl+0x3d/0x1f0
[ 64.445803][ T5830] panic+0x71d/0x800
[ 64.449679][ T5830] ? __pfx_panic+0x10/0x10
[ 64.454073][ T5830] ? irqentry_exit+0x3b/0x90
[ 64.458641][ T5830] ? lockdep_hardirqs_on+0x7c/0x110
[ 64.463817][ T5830] ? preempt_schedule_thunk+0x1a/0x30
[ 64.469166][ T5830] ? preempt_schedule_common+0x44/0xc0
[ 64.474602][ T5830] ? check_panic_on_warn+0x1f/0xb0
[ 64.479709][ T5830] check_panic_on_warn+0xab/0xb0
[ 64.484639][ T5830] end_report+0x117/0x180
[ 64.488943][ T5830] kasan_report+0xe9/0x110
[ 64.493336][ T5830] ? binder_add_device+0xa4/0xb0
[ 64.498264][ T5830] ? binder_add_device+0xa4/0xb0
[ 64.503177][ T5830] binder_add_device+0xa4/0xb0
[ 64.507917][ T5830] binderfs_binder_device_create.isra.0+0x95f/0xb70
[ 64.514492][ T5830] binderfs_fill_super+0x8d6/0x1360
[ 64.519674][ T5830] ? __pfx_binderfs_fill_super+0x10/0x10
[ 64.525314][ T5830] ? shrinker_register+0x1a8/0x260
[ 64.530418][ T5830] ? sget_fc+0x808/0xc20
[ 64.534643][ T5830] ? __pfx_set_anon_super_fc+0x10/0x10
[ 64.540095][ T5830] ? __pfx_binderfs_fill_super+0x10/0x10
[ 64.545718][ T5830] get_tree_nodev+0xda/0x190
[ 64.550288][ T5830] vfs_get_tree+0x8b/0x340
[ 64.554683][ T5830] path_mount+0x14e6/0x1f10
[ 64.559166][ T5830] ? kmem_cache_free+0x2e2/0x4d0
[ 64.564081][ T5830] ? __pfx_path_mount+0x10/0x10
[ 64.568905][ T5830] ? putname+0x13c/0x180
[ 64.573125][ T5830] __x64_sys_mount+0x28f/0x310
[ 64.577872][ T5830] ? __pfx___x64_sys_mount+0x10/0x10
[ 64.583142][ T5830] do_syscall_64+0xcd/0x250
[ 64.587624][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.593497][ T5830] RIP: 0033:0x7f5c0fd816ba
[ 64.597888][ T5830] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 64.617482][ T5830] RSP: 002b:00007ffc2db5bbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 64.625976][ T5830] RAX: ffffffffffffffda RBX: 00007f5c0fdf3d49 RCX: 00007f5c0fd816ba
[ 64.633954][ T5830] RDX: 00007f5c0fdff2fa RSI: 00007f5c0fdf3d49 RDI: 00007f5c0fdff2fa
[ 64.641918][ T5830] RBP: 00007f5c0fdf3f58 R08: 0000000000000000 R09: 00000000000001ff
[ 64.649864][ T5830] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c0fdde068
[ 64.657812][ T5830] R13: 00007f5c0fdde048 R14: 0000000000000009 R15: 0000000000000000
[ 64.665767][ T5830] </TASK>
[ 64.668899][ T5830] Kernel Offset: disabled
[ 64.673206][ T5830] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2275386146=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at b50eb251af
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=b50eb251af3b122fb1b2c574dde0c3d16f6a8cfd -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241203-163055'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"b50eb251af3b122fb1b2c574dde0c3d16f6a8cfd\"
/usr/bin/ld: /tmp/ccVVKqYN.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14b5e5f8580000
Tested on:
commit: 69e858e0 Merge tag 'uml-for-linus-6.14-rc1' of git://g..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=d1d4677fc8e45064
dashboard link: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-01-31 7:39 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-16 17:01 [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse syzbot
2023-11-17 14:23 ` [syzbot] Test syzbot
2023-11-21 19:19 ` [syzbot] [PATCH] Tried to correct syzbot
2023-11-22 8:08 ` kernel test robot
2023-12-23 19:59 ` [syzbot] [PATCH] usbhid: fix array-index-out-of-bounds in usbhid_parse UBSAN warning syzbot
2024-01-03 14:12 ` Dan Carpenter
2024-01-03 14:29 ` Aleksandr Nogikh
2024-03-05 18:55 ` [syzbot] " Kees Cook
2024-05-23 14:17 ` [syzbot] [usb?] UBSAN: array-index-out-of-bounds in usbhid_parse Nikita Zhandarovich
2024-05-24 1:56 ` syzbot
2025-01-30 10:20 ` Nikita Zhandarovich
2025-01-30 14:14 ` syzbot
2025-01-31 7:13 ` Nikita Zhandarovich
2025-01-31 7:39 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox