syzbot

 sign-in | mailing list | source | docs
🐞 Open [1278] ≡ Subsystems 🐞 Fixed [5372] 🐞 Invalid [12804] ⬇ Missing Backports [104] 📈 Kernel Health 📈 Bugs/Month 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in asus_report_fixup

Status: upstream: reported C repro on 2024/05/24 20:00
Subsystems: input usb
[Documentation on labels]
Reported-by: syzbot+07762f019fd03d01f04c@syzkaller.appspotmail.com
Fix commit: 89e1ee118d6f hid: asus: asus_report_fixup: fix potential read out of bounds
Patched on: [ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce], missing on: [ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci2-upstream-usb]
First crash: 27d, last: 1d18h
Cause bisection: introduced by (bisect log) :
commit 59d2f5b7392e988a391e6924e177c1a68d50223d
Author: Luke D. Jones <luke@ljones.dev>
Date: Tue Apr 16 09:03:59 2024 +0000

  HID: asus: fix more n-key report descriptors if n-key quirked

Crash: KASAN: slab-out-of-bounds Read in asus_report_fixup (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] hid: asus: asus_report_fixup: fix potential read out of bounds 5 (6) 2024/06/06 08:31
[syzbot] [input?] [usb?] KMSAN: uninit-value in asus_report_fixup 3 (5) 2024/05/31 08:53
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/05/28 12:29 22m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 70ec81c2e2b4 error OK
2024/05/28 05:07 22m andrewjballance@gmail.com patch upstream error OK

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in asus_report_fixup+0x12d2/0x1600 drivers/hid/hid-asus.c:1210
 asus_report_fixup+0x12d2/0x1600 drivers/hid/hid-asus.c:1210
 hid_open_report+0x20b/0x1790 drivers/hid/hid-core.c:1235
 hid_parse include/linux/hid.h:1118 [inline]
 asus_probe+0xd0f/0x16c0 drivers/hid/hid-asus.c:1065
 __hid_device_probe drivers/hid/hid-core.c:2633 [inline]
 hid_device_probe+0x40c/0x8d0 drivers/hid/hid-core.c:2670
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 hid_add_device+0x612/0x7d0 drivers/hid/hid-core.c:2816
 usbhid_probe+0x1596/0x1900 drivers/hid/usbhid/hid-core.c:1429
 usb_probe_interface+0xd6f/0x1350 drivers/usb/core/driver.c:399
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 usb_set_configuration+0x31c9/0x38d0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x109/0x2a0 drivers/usb/core/generic.c:254
 usb_probe_device+0x3a7/0x690 drivers/usb/core/driver.c:294
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 usb_new_device+0x15f4/0x2470 drivers/usb/core/hub.c:2652
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x4ff8/0x72d0 drivers/usb/core/hub.c:5904
 process_one_work kernel/workqueue.c:3267 [inline]
 process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3348
 worker_thread+0xea5/0x1560 kernel/workqueue.c:3429
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3877 [inline]
 slab_alloc_node mm/slub.c:3918 [inline]
 __do_kmalloc_node mm/slub.c:4038 [inline]
 __kmalloc_node_track_caller+0x767/0x10c0 mm/slub.c:4059
 kmemdup+0x48/0xc0 mm/util.c:131
 call_hid_bpf_rdesc_fixup include/linux/hid_bpf.h:157 [inline]
 hid_open_report+0x158/0x1790 drivers/hid/hid-core.c:1230
 hid_parse include/linux/hid.h:1118 [inline]
 asus_probe+0xd0f/0x16c0 drivers/hid/hid-asus.c:1065
 __hid_device_probe drivers/hid/hid-core.c:2633 [inline]
 hid_device_probe+0x40c/0x8d0 drivers/hid/hid-core.c:2670
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 hid_add_device+0x612/0x7d0 drivers/hid/hid-core.c:2816
 usbhid_probe+0x1596/0x1900 drivers/hid/usbhid/hid-core.c:1429
 usb_probe_interface+0xd6f/0x1350 drivers/usb/core/driver.c:399
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 usb_set_configuration+0x31c9/0x38d0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x109/0x2a0 drivers/usb/core/generic.c:254
 usb_probe_device+0x3a7/0x690 drivers/usb/core/driver.c:294
 really_probe+0x4db/0xd90 drivers/base/dd.c:656
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:798
 driver_probe_device+0x72/0x890 drivers/base/dd.c:828
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:956
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:457
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1028
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1077
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:532
 device_add+0x1475/0x1c90 drivers/base/core.c:3720
 usb_new_device+0x15f4/0x2470 drivers/usb/core/hub.c:2652
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x4ff8/0x72d0 drivers/usb/core/hub.c:5904
 process_one_work kernel/workqueue.c:3267 [inline]
 process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3348
 worker_thread+0xea5/0x1560 kernel/workqueue.c:3429
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

CPU: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.9.0-syzkaller-02707-g614da38e2f7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: usb_hub_wq hub_event
=====================================================

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/20 22:12 upstream 614da38e2f7a c0f1611a .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in asus_report_fixup
2024/05/21 04:43 upstream 70ec81c2e2b4 c0f1611a .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/20 19:55 upstream 614da38e2f7a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in asus_report_fixup
2024/05/26 18:30 upstream 9b62e02e6336 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/21 19:56 upstream 8f6a15f095a6 1014eca7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/15 03:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/13 16:00 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/13 13:11 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/12 15:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/12 08:35 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/11 18:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/10 09:34 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/08 03:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/06 16:27 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/06 14:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/06 13:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/06 00:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe 5aa1a7c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/05 12:22 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/05 05:09 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5821bf2dffbe e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/04 15:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing c3f38fa61af7 11f2afa5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/04 13:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing c3f38fa61af7 11f2afa5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/02 21:51 linux-next 0e1980c40b6e 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/02 14:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/06/01 16:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/31 13:15 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 0c378259 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/29 02:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/28 23:14 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/28 18:04 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/28 10:43 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c f550015e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/28 00:59 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1613e604df0c f550015e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/27 11:58 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 6fbf71854e2d 761766e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/27 00:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 6fbf71854e2d a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
2024/05/25 20:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing c760b3725e52 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb KASAN: slab-out-of-bounds Read in asus_report_fixup
* Struck through repros no longer work on HEAD.