Re: [syzbot] [input?] KASAN: null-ptr-deref Read in input_event

Hillf Danton
2025-01-06T10:52:27Z

On Sun, 05 Jan 2025 00:31:21 -0800
> syzbot found the following issue on:
>
> HEAD commit: f097a36ef88d dt-bindings: usb: qcom,dwc3: Add QCS615 to US..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e2a8b0580000

#syz test

--- x/include/linux/input.h
+++ y/include/linux/input.h
@@ -140,17 +140,17 @@ struct input_dev {
const char *uniq;
struct input_id id;

- unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
+ unsigned long propbit[1+ BITS_TO_LONGS(INPUT_PROP_CNT)];

- unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
- unsigned long keybit[BITS_TO_LONGS(KEY_CNT)];
- unsigned long relbit[BITS_TO_LONGS(REL_CNT)];
- unsigned long absbit[BITS_TO_LONGS(ABS_CNT)];
- unsigned long mscbit[BITS_TO_LONGS(MSC_CNT)];
- unsigned long ledbit[BITS_TO_LONGS(LED_CNT)];
- unsigned long sndbit[BITS_TO_LONGS(SND_CNT)];
- unsigned long ffbit[BITS_TO_LONGS(FF_CNT)];
- unsigned long swbit[BITS_TO_LONGS(SW_CNT)];
+ unsigned long evbit[1+ BITS_TO_LONGS(EV_CNT)];
+ unsigned long keybit[1+ BITS_TO_LONGS(KEY_CNT)];
+ unsigned long relbit[1+ BITS_TO_LONGS(REL_CNT)];
+ unsigned long absbit[1+ BITS_TO_LONGS(ABS_CNT)];
+ unsigned long mscbit[1+ BITS_TO_LONGS(MSC_CNT)];
+ unsigned long ledbit[1+ BITS_TO_LONGS(LED_CNT)];
+ unsigned long sndbit[1+ BITS_TO_LONGS(SND_CNT)];
+ unsigned long ffbit[1+ BITS_TO_LONGS(FF_CNT)];
+ unsigned long swbit[1+ BITS_TO_LONGS(SW_CNT)];

unsigned int hint_events_per_packet;

@@ -177,10 +177,10 @@ struct input_dev {

struct input_absinfo *absinfo;

- unsigned long key[BITS_TO_LONGS(KEY_CNT)];
- unsigned long led[BITS_TO_LONGS(LED_CNT)];
- unsigned long snd[BITS_TO_LONGS(SND_CNT)];
- unsigned long sw[BITS_TO_LONGS(SW_CNT)];
+ unsigned long key[1+ BITS_TO_LONGS(KEY_CNT)];
+ unsigned long led[1+ BITS_TO_LONGS(LED_CNT)];
+ unsigned long snd[1+ BITS_TO_LONGS(SND_CNT)];
+ unsigned long sw[1+ BITS_TO_LONGS(SW_CNT)];

int (*open)(struct input_dev *dev);
void (*close)(struct input_dev *dev);
--