[syzbot] [usb?] KASAN: slab-out-of-bounds Read in mon_copy_to_buff

23 views
Skip to first unread message

syzbot

unread,
Jul 7, 2025, 7:40:27 AM7/7/25
to gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: b4911fb0b060 Merge tag 'mmc-v6.16-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1681f982580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b0724e6945b4773
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4347c5e481b1/disk-b4911fb0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94e212cacf21/vmlinux-b4911fb0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8e0269b32eb1/bzImage-b4911fb0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com

microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
microsoft 0003:045E:07DA.000D: unknown main item tag 0x0
==================================================================
BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
Read of size 4032 at addr ffff8880330e0801 by task kworker/0:6/5887

CPU: 0 UID: 0 PID: 5887 Comm: kworker/0:6 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
__asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
mon_bin_get_data drivers/usb/mon/mon_bin.c:420 [inline]
mon_bin_event+0x1071/0x2050 drivers/usb/mon/mon_bin.c:606
mon_bus_submit+0xcf/0x140 drivers/usb/mon/mon_main.c:89
usbmon_urb_submit include/linux/usb/hcd.h:724 [inline]
usb_hcd_submit_urb+0x12d/0x1c60 drivers/usb/core/hcd.c:1518
usb_submit_urb+0x87c/0x1790 drivers/usb/core/urb.c:581
usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:928 [inline]
usbhid_raw_request+0x58f/0x700 drivers/hid/usbhid/hid-core.c:1299
__hid_request+0x299/0x3c0 drivers/hid/hid-core.c:1989
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x363/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
hub_port_connect drivers/usb/core/hub.c:5535 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
port_event drivers/usb/core/hub.c:5835 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5917
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Allocated by task 5887:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4340
__hid_request+0x2c/0x3c0 drivers/hid/hid-core.c:1980
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x363/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
hub_port_connect drivers/usb/core/hub.c:5535 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
port_event drivers/usb/core/hub.c:5835 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5917
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880330e0800
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes inside of
allocated 7-byte region [ffff8880330e0800, ffff8880330e0807)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x330e0
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b841500 ffffea000085b700 dead000000000002
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (init), ts 15743776341, free_ts 15035826353
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x2f2/0x510 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
str_read+0x58/0x220 security/selinux/ss/policydb.c:1104
genfs_read+0x688/0xe20 security/selinux/ss/policydb.c:2194
policydb_read+0x28de/0x3220 security/selinux/ss/policydb.c:2707
security_load_policy+0x15c/0x12c0 security/selinux/ss/services.c:2305
sel_write_load+0x332/0x1bd0 security/selinux/selinuxfs.c:603
vfs_write+0x29d/0x1150 fs/read_write.c:684
ksys_write+0x12a/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
kasan_depopulate_vmalloc_pte+0x5f/0x80 mm/kasan/shadow.c:472
apply_to_pte_range mm/memory.c:3032 [inline]
apply_to_pmd_range mm/memory.c:3076 [inline]
apply_to_pud_range mm/memory.c:3112 [inline]
apply_to_p4d_range mm/memory.c:3148 [inline]
__apply_to_page_range+0xa92/0x1350 mm/memory.c:3184
kasan_release_vmalloc+0xd1/0xe0 mm/kasan/shadow.c:593
kasan_release_vmalloc_node mm/vmalloc.c:2241 [inline]
purge_vmap_node+0x1c4/0xa30 mm/vmalloc.c:2258
__purge_vmap_area_lazy+0xa06/0xc60 mm/vmalloc.c:2348
_vm_unmap_aliases+0x43b/0x670 mm/vmalloc.c:2943
change_page_attr_set_clr+0x252/0x4a0 arch/x86/mm/pat/set_memory.c:2088
change_page_attr_set arch/x86/mm/pat/set_memory.c:2129 [inline]
set_memory_nx+0xb5/0x110 arch/x86/mm/pat/set_memory.c:2318
free_init_pages+0x79/0xd0 arch/x86/mm/init.c:933
free_kernel_image_pages+0x24/0x50 arch/x86/mm/init.c:952
kernel_init+0x30/0x2b0 init/main.c:1483
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
ffff8880330e0700: 00 fc fc fc 04 fc fc fc 06 fc fc fc 06 fc fc fc
ffff8880330e0780: 05 fc fc fc 05 fc fc fc 05 fc fc fc 00 fc fc fc
>ffff8880330e0800: 07 fc fc fc fa fc fc fc 05 fc fc fc fa fc fc fc
^
ffff8880330e0880: 06 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc
ffff8880330e0900: fa fc fc fc fa fc fc fc fa fc fc fc 05 fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,
Jul 7, 2025, 11:05:30 AM7/7/25
to gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: d7b8f8e20813 Linux 6.16-rc5
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17e89582580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b3cbd4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11b19f70580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f933e0e4a6c5/disk-d7b8f8e2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a82be954c91b/vmlinux-d7b8f8e2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/66dbc3de1264/bzImage-d7b8f8e2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com

microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
==================================================================
BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
Read of size 3904 at addr ffff8880216bc6e1 by task kworker/0:2/1204

CPU: 0 UID: 0 PID: 1204 Comm: kworker/0:2 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
__asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
mon_bin_get_data drivers/usb/mon/mon_bin.c:420 [inline]
mon_bin_event+0x1071/0x2050 drivers/usb/mon/mon_bin.c:606
mon_bus_submit+0xcf/0x140 drivers/usb/mon/mon_main.c:89
usbmon_urb_submit include/linux/usb/hcd.h:724 [inline]
usb_hcd_submit_urb+0x12d/0x1c60 drivers/usb/core/hcd.c:1518
usb_submit_urb+0x87c/0x1790 drivers/usb/core/urb.c:581
usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:928 [inline]
usbhid_raw_request+0x58f/0x700 drivers/hid/usbhid/hid-core.c:1299
__hid_request+0x296/0x3c0 drivers/hid/hid-core.c:1989
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5866 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5948
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Allocated by task 1204:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4340
__hid_request+0x2c/0x3c0 drivers/hid/hid-core.c:1980
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x303/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5866 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5948
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880216bc6e0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes inside of
allocated 7-byte region [ffff8880216bc6e0, ffff8880216bc6e7)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x216bc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b841500 ffffea00009fbac0 dead000000000002
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2412854036, free_ts 2374376433
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x2f2/0x510 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
acpi_ns_internalize_name+0x144/0x220 drivers/acpi/acpica/nsutils.c:331
acpi_ns_get_node_unlocked+0x163/0x310 drivers/acpi/acpica/nsutils.c:666
acpi_ns_get_node+0x4c/0x70 drivers/acpi/acpica/nsutils.c:726
acpi_get_handle+0x105/0x270 drivers/acpi/acpica/nsxfname.c:98
acpi_has_method+0x7a/0xc0 drivers/acpi/utils.c:672
acpi_show_attr drivers/acpi/device_sysfs.c:560 [inline]
acpi_attr_is_visible+0x435/0x540 drivers/acpi/device_sysfs.c:588
create_files fs/sysfs/group.c:65 [inline]
internal_create_group+0x501/0xf30 fs/sysfs/group.c:183
internal_create_groups+0x9d/0x150 fs/sysfs/group.c:223
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
__kmem_cache_do_shrink+0x30b/0x380 mm/slub.c:6137
acpi_os_purge_cache+0x15/0x20 drivers/acpi/osl.c:1605
acpi_purge_cached_objects+0x86/0x100 drivers/acpi/acpica/utxface.c:239
acpi_initialize_objects+0x47/0xa0 drivers/acpi/acpica/utxfinit.c:250
acpi_bus_init drivers/acpi/bus.c:1367 [inline]
acpi_init+0x168/0xb60 drivers/acpi/bus.c:1456
do_one_initcall+0x120/0x6e0 init/main.c:1274
do_initcall_level init/main.c:1336 [inline]
do_initcalls init/main.c:1352 [inline]
do_basic_setup init/main.c:1371 [inline]
kernel_init_freeable+0x5c2/0x900 init/main.c:1584
kernel_init+0x1c/0x2b0 init/main.c:1474
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
ffff8880216bc580: fa fc fc fc fa fc fc fc 00 fc fc fc fa fc fc fc
ffff8880216bc600: 00 fc fc fc 00 fc fc fc fa fc fc fc 00 fc fc fc
>ffff8880216bc680: fa fc fc fc fa fc fc fc 00 fc fc fc 07 fc fc fc
^
ffff8880216bc700: 00 fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff8880216bc780: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Alan Stern

unread,
Jul 7, 2025, 2:09:30 PM7/7/25
to syzbot, Manas, Arnaud Lecomte, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, Jul 07, 2025 at 08:05:27AM -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: d7b8f8e20813 Linux 6.16-rc5
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=17e89582580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
> dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b3cbd4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11b19f70580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/f933e0e4a6c5/disk-d7b8f8e2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/a82be954c91b/vmlinux-d7b8f8e2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/66dbc3de1264/bzImage-d7b8f8e2.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com
>
> microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
> microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
> Read of size 3904 at addr ffff8880216bc6e1 by task kworker/0:2/1204

Test my guess that the report length and ID are both 0, which would
cause the length to be decremented erroneously.

Alan Stern

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ d7b8f8e20813

drivers/hid/usbhid/hid-core.c | 1 +
1 file changed, 1 insertion(+)

Index: usb-devel/drivers/hid/usbhid/hid-core.c
===================================================================
--- usb-devel.orig/drivers/hid/usbhid/hid-core.c
+++ usb-devel/drivers/hid/usbhid/hid-core.c
@@ -918,6 +918,7 @@ static int usbhid_set_raw_report(struct
else
buf[0] = reportnum;

+ dev_info(&intf->dev, "count %u reportnum %u buf[0] %u\n", count, reportnum, buf[0]);
if (buf[0] == 0x0) {
/* Don't send the Report ID */
buf++;

syzbot

unread,
Jul 7, 2025, 2:41:06 PM7/7/25
to con...@arnaud-lcm.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, manas...@iiitd.ac.in, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-out-of-bounds Read in mon_copy_to_buff

microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
usbhid 1-1:0.0: count 0 reportnum 0 buf[0] 0
==================================================================
BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
Read of size 3904 at addr ffff8880222d53c1 by task kworker/1:2/3689

CPU: 1 UID: 0 PID: 3689 Comm: kworker/1:2 Not tainted 6.16.0-rc5-syzkaller-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
__asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
mon_bin_get_data drivers/usb/mon/mon_bin.c:420 [inline]
mon_bin_event+0x1071/0x2050 drivers/usb/mon/mon_bin.c:606
mon_bus_submit+0xcf/0x140 drivers/usb/mon/mon_main.c:89
usbmon_urb_submit include/linux/usb/hcd.h:724 [inline]
usb_hcd_submit_urb+0x12d/0x1c60 drivers/usb/core/hcd.c:1518
usb_submit_urb+0x87c/0x1790 drivers/usb/core/urb.c:581
usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:929 [inline]
usbhid_raw_request+0x29a/0x710 drivers/hid/usbhid/hid-core.c:1300
__hid_request+0x296/0x3c0 drivers/hid/hid-core.c:1989
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1436
Allocated by task 3689:
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1436
The buggy address belongs to the object at ffff8880222d53c0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes inside of
allocated 7-byte region [ffff8880222d53c0, ffff8880222d53c7)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222d5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b841500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2690993754, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_node_track_caller_noprof+0x2ee/0x510 mm/slub.c:4347
__kmemdup_nul mm/util.c:63 [inline]
kstrdup+0x53/0x100 mm/util.c:83
kstrdup_const+0x63/0x80 mm/util.c:103
__kernfs_new_node+0x9b/0x8e0 fs/kernfs/dir.c:633
kernfs_new_node+0x13c/0x1e0 fs/kernfs/dir.c:713
kernfs_create_link+0xcc/0x240 fs/kernfs/symlink.c:39
sysfs_do_create_link_sd+0x90/0x140 fs/sysfs/symlink.c:44
sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
sysfs_create_link+0x61/0xc0 fs/sysfs/symlink.c:92
device_add_class_symlinks drivers/base/core.c:3451 [inline]
device_add+0x62c/0x1a70 drivers/base/core.c:3643
page_owner free stack trace missing

Memory state around the buggy address:
ffff8880222d5280: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff8880222d5300: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff8880222d5380: fa fc fc fc 00 fc fc fc 07 fc fc fc 00 fc fc fc
^
ffff8880222d5400: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
ffff8880222d5480: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
==================================================================


Tested on:

commit: d7b8f8e2 Linux 6.16-rc5
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=10c82bd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1553428c580000

Alan Stern

unread,
Jul 7, 2025, 3:18:15 PM7/7/25
to syzbot, con...@arnaud-lcm.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, manas...@iiitd.ac.in, syzkall...@googlegroups.com
On Mon, Jul 07, 2025 at 11:41:04AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: slab-out-of-bounds Read in mon_copy_to_buff
>
> microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
> microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
> usbhid 1-1:0.0: count 0 reportnum 0 buf[0] 0

Aha! As I expected.

> ==================================================================
> BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
> Read of size 3904 at addr ffff8880222d53c1 by task kworker/1:2/3689

Let's see if this fixes it.

Alan Stern

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ d7b8f8e20813

drivers/hid/usbhid/hid-core.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)

Index: usb-devel/drivers/hid/usbhid/hid-core.c
===================================================================
--- usb-devel.orig/drivers/hid/usbhid/hid-core.c
+++ usb-devel/drivers/hid/usbhid/hid-core.c
@@ -911,14 +911,13 @@ static int usbhid_set_raw_report(struct
struct usb_host_interface *interface = intf->cur_altsetting;
int ret, skipped_report_id = 0;

- /* Byte 0 is the report number. Report data starts at byte 1.*/
- if ((rtype == HID_OUTPUT_REPORT) &&
- (hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID))
- buf[0] = 0;
- else
- buf[0] = reportnum;
-
- if (buf[0] == 0x0) {
+ /*
+ * If the report ID number is 0 then report data starts at byte 0.
+ * Otherwise byte 0 is the report number and report data starts
+ * at byte 1.
+ */
+ if (rtype == HID_OUTPUT_REPORT && reportnum > 0 &&
+ (hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID)) {
/* Don't send the Report ID */
buf++;
count--;

syzbot

unread,
Jul 7, 2025, 3:48:05 PM7/7/25
to con...@arnaud-lcm.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, manas...@iiitd.ac.in, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com
Tested-by: syzbot+8258d5...@syzkaller.appspotmail.com

Tested on:

commit: d7b8f8e2 Linux 6.16-rc5
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=1517428c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=122e9582580000

Note: testing is done by a robot and is best-effort only.

Alan Stern

unread,
Jul 9, 2025, 11:28:17 AM7/9/25
to syzbot, Benjamin Tissoires, Jiri Kosina, linux...@vger.kernel.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
Here's Benjamin Tissoires's patch. Let's see if it really fixes the
problem.

Alan Stern

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ d7b8f8e20813

The low level transport driver expects the first byte to be the report
ID, even when the report ID is not use (in which case they just shift
the buffer).

However, __hid_request() whas not offsetting the buffer it used by one
in this case, meaning that the raw_request() callback emitted by the
transport driver would be stripped of the first byte.

Reported-by: Alan Stern <st...@rowland.harvard.edu>
Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072...@rowland.harvard.edu/
Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()")
Cc: sta...@vger.kernel.org
Signed-off-by: Benjamin Tissoires <ben...@kernel.org>
---
drivers/hid/hid-core.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1a231dd9e4bc83202f2cbcd8b3a21e8c82b9deec..320887c365f7a36f7376556ffd19f99e52b7d732 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1976,7 +1976,7 @@ static struct hid_report *hid_get_report(struct hid_report_enum *report_enum,
int __hid_request(struct hid_device *hid, struct hid_report *report,
enum hid_class_request reqtype)
{
- char *buf;
+ char *buf, *data_buf;
int ret;
u32 len;

@@ -1984,10 +1984,17 @@ int __hid_request(struct hid_device *hid, struct hid_report *report,
if (!buf)
return -ENOMEM;

+ data_buf = buf;
len = hid_report_len(report);

+ if (report->id == 0) {
+ /* reserve the first byte for the report ID */
+ data_buf++;
+ len++;
+ }
+
if (reqtype == HID_REQ_SET_REPORT)
- hid_output_report(report, buf);
+ hid_output_report(report, data_buf);

ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
report->type, reqtype);

--
2.49.0

syzbot

unread,
Jul 9, 2025, 11:56:06 AM7/9/25
to ben...@kernel.org, ji...@kernel.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+8258d5...@syzkaller.appspotmail.com
Tested-by: syzbot+8258d5...@syzkaller.appspotmail.com

Tested on:

commit: d7b8f8e2 Linux 6.16-rc5
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=1155ebd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1113ff70580000

Alan Stern

unread,
Jul 9, 2025, 1:53:04 PM7/9/25
to syzbot, Benjamin Tissoires, Jiri Kosina, linux...@vger.kernel.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
Test patch to see the contents of the report descriptor.

Alan Stern

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ d7b8f8e20813

Index: usb-devel/drivers/hid/usbhid/hid-core.c
===================================================================
--- usb-devel.orig/drivers/hid/usbhid/hid-core.c
+++ usb-devel/drivers/hid/usbhid/hid-core.c
@@ -1043,6 +1043,10 @@ static int usbhid_parse(struct hid_devic
goto err;
}

+ dev_info(&intf->dev, "Report descriptor:\n");
+ print_hex_dump(KERN_INFO, " * ", DUMP_PREFIX_NONE, 16, 1,
+ rdesc, rsize, false);
+
ret = hid_parse_report(hid, rdesc, rsize);
kfree(rdesc);
if (ret) {

syzbot

unread,
Jul 9, 2025, 2:29:05 PM7/9/25
to ben...@kernel.org, ji...@kernel.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-out-of-bounds Read in mon_copy_to_buff

* 00 00 00 b3 81 3e 25 03 1b dd e8 40 50 3b 5d 8c
* 3d da
microsoft 0003:045E:07DA.0001: unknown main item tag 0x0
microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
==================================================================
BUG: KASAN: slab-out-of-bounds in mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
Read of size 3904 at addr ffff88802a9b20a1 by task kworker/1:2/3087

CPU: 1 UID: 0 PID: 3087 Comm: kworker/1:2 Not tainted 6.16.0-rc5-syzkaller-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xcd/0x680 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
__asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
mon_copy_to_buff+0xc2/0x170 drivers/usb/mon/mon_bin.c:252
mon_bin_get_data drivers/usb/mon/mon_bin.c:420 [inline]
mon_bin_event+0x1071/0x2050 drivers/usb/mon/mon_bin.c:606
mon_bus_submit+0xcf/0x140 drivers/usb/mon/mon_main.c:89
usbmon_urb_submit include/linux/usb/hcd.h:724 [inline]
usb_hcd_submit_urb+0x12d/0x1c60 drivers/usb/core/hcd.c:1518
usb_submit_urb+0x87c/0x1790 drivers/usb/core/urb.c:581
usb_start_wait_urb+0x104/0x4b0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x326/0x4a0 drivers/usb/core/message.c:154
usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:928 [inline]
usbhid_raw_request+0x58f/0x700 drivers/hid/usbhid/hid-core.c:1303
__hid_request+0x296/0x3c0 drivers/hid/hid-core.c:1989
hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
hid_connect+0x13f3/0x1a60 drivers/hid/hid-core.c:2239
hid_hw_start drivers/hid/hid-core.c:2354 [inline]
hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2345
ms_probe+0x195/0x500 drivers/hid/hid-microsoft.c:391
__hid_device_probe drivers/hid/hid-core.c:2724 [inline]
hid_device_probe+0x360/0x720 drivers/hid/hid-core.c:2761
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
hid_add_device+0x373/0xa60 drivers/hid/hid-core.c:2907
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1439
Allocated by task 3087:
usbhid_probe+0xd38/0x13f0 drivers/hid/usbhid/hid-core.c:1439
The buggy address belongs to the object at ffff88802a9b20a0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes inside of
allocated 7-byte region [ffff88802a9b20a0, ffff88802a9b20a7)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a9b2
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b841500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 10064691813, free_ts 9935982490
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab mm/slub.c:2619 [inline]
new_slab+0x23b/0x330 mm/slub.c:2673
___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__kmalloc_cache_noprof+0xfb/0x3e0 mm/slub.c:4354
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
usb_get_bos_descriptor+0x62/0xbb0 drivers/usb/core/config.c:1037
register_root_hub+0x332/0x730 drivers/usb/core/hcd.c:983
usb_add_hcd+0xaf2/0x1730 drivers/usb/core/hcd.c:2976
vhci_hcd_probe+0x1c2/0x490 drivers/usb/usbip/vhci_hcd.c:1377
platform_probe+0x102/0x1f0 drivers/base/platform.c:1404
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
page last free pid 1206 tgid 1206 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
vfree+0x1fd/0xb50 mm/vmalloc.c:3426
delayed_vfree_work+0x56/0x70 mm/vmalloc.c:3345
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
ffff88802a9b1f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88802a9b2000: 00 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
>ffff88802a9b2080: 00 fc fc fc 07 fc fc fc 06 fc fc fc 00 fc fc fc
^
ffff88802a9b2100: fa fc fc fc 00 fc fc fc 06 fc fc fc 06 fc fc fc
ffff88802a9b2180: 06 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
==================================================================


Tested on:

commit: d7b8f8e2 Linux 6.16-rc5
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=10bd1a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f51185bd4f40ad44
dashboard link: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=135800f0580000

Reply all
Reply to author
Forward
0 new messages