syzbot

 sign-in | mailing list | source | docs
🐞 Open [1486]
≡ Subsystems
🐞 Fixed [6521]
🐞 Invalid [16597]
⬇ Missing Backports [204]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

UBSAN: shift-out-of-bounds in ax88772_bind

Status: upstream: reported C repro on 2025/08/16 03:08
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com
Fix commit: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Patched on: [ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 4d22h, last: 20h45m
Cause bisection: introduced by (bisect log) :
commit 4faff70959d51078f9ee8372f8cff0d7045e4114
Author: Xu Yang <xu.yang_2@nxp.com>
Date: Mon Aug 11 09:29:31 2025 +0000

  net: usb: asix_devices: add phy_mask for ax88772 mdio bus

Crash: UBSAN: shift-out-of-bounds in ax88772_bind (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization 3 (3) 2025/08/20 03:11
[syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind 3 (9) 2025/08/18 06:53
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2025/08/18 06:22 22m yuichtsu@amazon.com patch upstream OK log
2025/08/18 05:13 0m yuichtsu@amazon.com patch upstream error
2025/08/18 04:05 52m yuichtsu@amazon.com patch upstream error
2025/08/17 19:42 37m abinashsinghlalotra@gmail.com patch upstream error

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/net/usb/asix_devices.c:679:27
shift exponent 208 is too large for 64-bit type 'unsigned long'
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.17.0-rc1-syzkaller-00214-g99bade344cfa #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
 ax88772_init_mdio drivers/net/usb/asix_devices.c:679 [inline]
 ax88772_bind+0xdcf/0xfa0 drivers/net/usb/asix_devices.c:910
 usbnet_probe+0xa96/0x2870 drivers/net/usb/usbnet.c:1781
 usb_probe_interface+0x668/0xc30 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26a/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x185/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c1/0x390 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x26a/0x9e0 drivers/base/dd.c:659
 __driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
 driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
 __device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
 bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
 __device_attach+0x2b8/0x400 drivers/base/dd.c:1031
 bus_probe_device+0x185/0x260 drivers/base/bus.c:537
 device_add+0x7b6/0xb50 drivers/base/core.c:3689
 usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694
 hub_port_connect drivers/usb/core/hub.c:5566 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5870 [inline]
 hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/17 16:51 upstream 99bade344cfa 1804e95e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 21:32 upstream 90d970cade8e 1804e95e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 08:21 upstream dfd4b508c8c6 1804e95e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 03:23 upstream d7ee5bdce789 1804e95e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 01:49 upstream d7ee5bdce789 1804e95e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/19 15:25 upstream be48bcf004f9 523f460e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/19 12:38 upstream be48bcf004f9 523f460e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/18 07:57 upstream 8d561baae505 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/17 15:07 upstream 99bade344cfa 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 20:47 upstream 90d970cade8e 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 07:26 upstream dfd4b508c8c6 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/16 00:26 upstream d7ee5bdce789 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/20 02:15 linux-next 886e5e7b0432 79512909 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
2025/08/18 23:06 linux-next 3ac864c2d9bb 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce UBSAN: shift-out-of-bounds in ax88772_bind
* Struck through repros no longer work on HEAD.