From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f69.google.com (mail-ot1-f69.google.com [209.85.210.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D0BF3BB4A for ; Thu, 6 Aug 2026 13:44:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.69 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786023894; cv=none; b=kBF7sRH7/b1CH02kINtI2wKSE3NTG0QB7YSliSUeI1IEuE4o/JG7HqWaECe2axVpoZ6IRz+xeLgKjGPvHVotsizcPOBDcF+Z9Ch0K1qcorzrkMQNLIg8SxpXxcQg+dvkmV/5p7TWupRCtO9FYn7XOxsX3EJqzSdD881PTNsckO8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786023894; c=relaxed/simple; bh=mxQx6QFArEMVHmHhbhhUG7fCSZ4r4Qkbhko+oVHt+cM=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=CRgz+EtffiruDbozoC4Lbb3fPXDLfyc9/Tn0LXA/cwtFUApjgoo0N0aiG9DpF78gEvQ+qRlRryLG34GaYDv6oBOjUHvJKroxi2Hg2AlH+p3I2Xmu96aODicE+7BpM5Ff1YOzm39ohtiBGyJATShH1F1jN7gSD9M8w32jFWwb5Ug= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f69.google.com with SMTP id 46e09a7af769-7e6b59d85dcso3032050a34.3 for ; Thu, 06 Aug 2026 06:44:50 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786023889; x=1786628689; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JXYTfrFLWAoL+in0Z+WVqwrHAuGkYov1bD+EfYqw/Vs=; b=c2bvIlvFENhfIQZSLhs5cMUUEEGkZBLww4u8MrXtLnD9Zh/QvNDstfOFe4eG+Q8uRM 9UP3S+SXLGVe1PNTgRLx2VG7wo+gxNfksyC142kcnoUPxcuSGKTZNWTW539oQ0mDLs1f AvhV/wylEbtBf4IZ+u2qoFQv75c5Hke15zp3lXrkIljByn2rSDFM1/LlQLveKKBBMkqV kwFqwq7gAU4p/aldh1YG9fGYAJz2nycOsCJH17M44kQ0bkWbW+LzNlC6lBW0Sw/+TAav a3NprBzrkZRtH7m3FCzF3yurVjtBLl8Iq3pOp15LDn5XdGhxFrNFsl8pPV8Bt7z+YdEP FmGA== X-Gm-Message-State: AOJu0Yz/pTeX3+ZtbgDIL1nbL6J+aiC9OE2doADSI+ApmeOGLcCkYARa QB0sDudwSpBwXpsQUcTIKS3L5rP8PuSMfnv7g90aYmE8hGBUj345L4x0Rc5NYtMbkcuzJ7MhOjk KOtnToUIiPzZ4u0owivUeBVnVGF+/F04SrpBSWQOkkUDDe7fJtlpMuJCoKhQ= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:609:b0:6a3:1dc5:3570 with SMTP id 006d021491bc7-6ae96fde766mr6880021eaf.31.1786023888770; Thu, 06 Aug 2026 06:44:48 -0700 (PDT) Date: Thu, 06 Aug 2026 06:44:48 -0700 In-Reply-To: <6a694712.6bd615f2.c0aa.0003.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a748fd0.01d0871a.3a0d52.001c.GAE@google.com> Subject: Forwarded: [PATCH v2 test] usb: usbtest: disable dynamic ID support From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH v2 test] usb: usbtest: disable dynamic ID support Author: nogikh@google.com #syz test The usbtest driver relies on the driver_info field of struct usb_device_id to point to a valid struct usbtest_info descriptor. This structure contains essential test configurations, such as endpoint addresses and test modes, which are required during probe. When a user dynamically adds a new device ID via the sysfs new_id interface without specifying a reference device, the USB core initializes driver_info to 0 (NULL). When a matching device is subsequently probed, usbtest_probe() unconditionally casts driver_info to a struct usbtest_info pointer and dereferences it, leading to a NULL pointer dereference crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822 Because usbtest strictly requires pre-defined usbtest_info descriptors to function, dynamic ID binding via sysfs is fundamentally unsupported for this driver. Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs the USB core to skip creating the new_id and remove_id sysfs interfaces for usbtest, preventing invalid dynamic ID entries from being created. Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7 Signed-off-by: Aleksandr Nogikh --- Changes in v2: - Disable dynamic IDs via .no_dynamic_id = 1 instead of adding a runtime NULL check in probe(). - Link to v1: https://lore.kernel.org/r/2650cf0f-26f9-48b5-b198-e4cb67c59cf0@mail.kernel.org drivers/usb/misc/usbtest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index 98071b25ac076..8759df49be287 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c @@ -3054,6 +3054,7 @@ static struct usb_driver usbtest_driver = { .disconnect = usbtest_disconnect, .suspend = usbtest_suspend, .resume = usbtest_resume, + .no_dynamic_id = 1, }; /*-------------------------------------------------------------------------*/ -- base-commit: 48a5a7ab8d6ab7090564339e039c421f315de912 -- 2.55.0.654.g21b8a5bc05-goog