syzbot
UBSAN: shift-out-of-bounds in option_probe
Status:
fixed on 2021/03/10 01:48
Subsystems:
usb
[Documentation on labels]
Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
Fix commit:
a251963f76fa
USB: serial: option: add interface-number sanity check to flag handling
First crash: 2057d, last: 2054d
Sample crash report:
usb 1-1: config 0 interface 109 has no altsetting 0
usb 1-1: New USB device found, idVendor=12d1, idProduct=02cb, bcdDevice= 1.fb
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: config 0 descriptor??
================================================================================
UBSAN: shift-out-of-bounds in drivers/usb/serial/option.c:2120:21
shift exponent 109 is too large for 64-bit type 'long unsigned int'
CPU: 0 PID: 3169 Comm: kworker/0:3 Not tainted 5.10.0-rc6-next-20201207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
option_probe.cold+0x1a/0x1f drivers/usb/serial/option.c:2120
usb_serial_probe+0x32d/0xef0 drivers/usb/serial/usb-serial.c:905
usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
really_probe+0x2b1/0xe40 drivers/base/dd.c:554
driver_probe_device+0x285/0x3f0 drivers/base/dd.c:738
__device_attach_driver+0x216/0x2d0 drivers/base/dd.c:844
* Struck through repros no longer work on HEAD.