syzbot

 sign-in | mailing list | source | docs
🐞 Open [982] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12474] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: shift-out-of-bounds in snto32

Status: fixed on 2021/04/09 19:46
Subsystems: input usb
[Documentation on labels]
Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
Fix commit: a0312af1f94d HID: core: detect and skip invalid inputs to snto32()
First crash: 1226d, last: 1149d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
UBSAN: shift-out-of-bounds in hid_report_raw_event input usb C 4 1162d 1158d 0/26 closed as dup on 2021/02/16 22:41
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[PATCH 4.19 000/247] 4.19.178-rc1 review 277 (277) 2022/03/02 15:52
[PATCH 5.10 000/663] 5.10.20-rc1 review 673 (673) 2021/03/05 18:03
[PATCH 5.4 000/340] 5.4.102-rc1 review 348 (348) 2021/03/04 09:26
[PATCH 4.4 00/93] 4.4.259-rc1 review 99 (99) 2021/03/02 19:02
[PATCH 4.9 000/134] 4.9.259-rc1 review 137 (137) 2021/03/01 21:45
[PATCH 5.11 000/775] 5.11.3-rc1 review 776 (776) 2021/03/01 16:15
[PATCH 4.14 000/176] 4.14.223-rc1 review 177 (177) 2021/03/01 16:14
[PATCH] HID: core: detect and skip invalid inputs to snto32() 2 (2) 2021/01/08 13:52
UBSAN: shift-out-of-bounds in snto32 0 (1) 2020/12/13 23:43
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in snto32 (2) usb input C inconclusive done 5 551d 593d 0/26 auto-obsoleted due to no activity on 2023/04/21 11:23

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1315:20
shift exponent 4294967295 is too large for 32-bit type 'int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 snto32.cold+0x37/0x3c drivers/hid/hid-core.c:1315
 hid_input_field drivers/hid/hid-core.c:1548 [inline]
 hid_report_raw_event+0x7a9/0x11b0 drivers/hid/hid-core.c:1783
 hid_input_report+0x360/0x4c0 drivers/hid/hid-core.c:1850
 hid_irq_in+0x50e/0x690 drivers/hid/usbhid/hid-core.c:284
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726
 dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971
 call_timer_fn+0x1a5/0x630 kernel/time/timer.c:1417
 expire_timers kernel/time/timer.c:1462 [inline]
 __run_timers.part.0+0x67c/0xa10 kernel/time/timer.c:1731
 __run_timers kernel/time/timer.c:1712 [inline]
 run_timer_softirq+0x80/0x120 kernel/time/timer.c:1744
 __do_softirq+0x1b0/0x944 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu kernel/softirq.c:420 [inline]
 irq_exit_rcu+0x110/0x1a0 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:629
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:79 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:169 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 drivers/acpi/processor_idle.c:516
Code: 1d bd 93 fb 84 db 75 ac e8 94 b6 93 fb e8 df 70 99 fb e9 0c 00 00 00 e8 85 b6 93 fb 0f 00 2d 3e 27 7c 00 e8 79 b6 93 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 54 be 93 fb 48 85 db
RSP: 0018:ffffffff87807d60 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffffffff878520c0 RSI: ffffffff85abe707 RDI: ffffffff85abe6f1
RBP: ffff8881035ed064 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff81455808 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8881035ed000 R14: ffff8881035ed064 R15: ffff888105ecf804
 acpi_idle_enter+0x355/0x4f0 drivers/acpi/processor_idle.c:647
 cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x3d5/0x580 kernel/sched/idle.c:299
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:396
 start_kernel+0x46d/0x48e init/main.c:1061
 secondary_startup_64_no_verify+0xb0/0xbb
================================================================================

Crashes (58):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/12 01:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 7a1e838d0cdc a5f86b15 .config console log report syz C ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2020/12/10 02:24 linux-next a9e26cb5f261 c090b4da .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2021/02/12 06:12 upstream 291009f656e8 a5f86b15 .config console log report info ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in snto32
2021/02/11 22:41 upstream 291009f656e8 a5f86b15 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in snto32
2021/02/09 10:12 upstream e0756cfc7d7c 2bd9619f .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in snto32
2021/02/24 11:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3b9cdafb5358 fcc6d71b .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/20 13:14 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 3e5ed8b4 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/20 06:48 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 f689d40a .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/19 00:43 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 14052202 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/17 19:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 14052202 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/17 17:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 052f8d9f .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/17 01:50 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 98682e5e .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/14 11:58 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b5a12546e779 98682e5e .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/12 15:37 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 7a1e838d0cdc a5f86b15 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/12 12:49 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 7a1e838d0cdc a5f86b15 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/08 01:30 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8cf9045b9138 2ce644fc .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/06 16:00 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8cf9045b9138 0655e081 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/06 15:14 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8cf9045b9138 0655e081 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/04 16:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 2a1673f0f1de 42b90a7c .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/04 02:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 0e1d6f55a12e 624dad51 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/01 23:05 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 29b01295a829 e6b95f32 .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/02/01 04:30 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3c648d3deb0f fc9fd31e .config console log report info ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2021/01/10 07:48 upstream 2ff90100ace8 2c1f2513 .config console log report info ci-upstream-kasan-gce
2021/01/10 07:40 upstream 2ff90100ace8 2c1f2513 .config console log report info ci-upstream-kasan-gce-root
2021/01/10 06:22 upstream 2ff90100ace8 2c1f2513 .config console log report info ci-upstream-kasan-gce
2021/01/10 05:46 upstream 2ff90100ace8 2c1f2513 .config console log report info ci-upstream-kasan-gce-root
2020/12/18 04:25 upstream d64c6f96ba86 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/16 23:10 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/16 20:04 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/16 19:55 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/16 19:41 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/16 19:40 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/16 18:16 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/16 23:32 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-386
2020/12/16 19:15 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-386
2021/01/11 00:47 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d89d5a 2c1f2513 .config console log report info ci2-upstream-usb
2021/01/10 05:47 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d89d5a 2c1f2513 .config console log report info ci2-upstream-usb
2021/01/09 22:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d89d5a 2c1f2513 .config console log report info ci2-upstream-usb
2021/01/09 22:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d89d5a 2c1f2513 .config console log report info ci2-upstream-usb
2020/12/26 03:37 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2dda7 821e0b09 .config console log report info ci2-upstream-usb
2020/12/20 01:18 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2dda7 04201c06 .config console log report info ci2-upstream-usb
2020/12/19 19:52 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2dda7 04201c06 .config console log report info ci2-upstream-usb
2020/12/19 13:39 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/18 22:07 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/18 13:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/18 07:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/18 04:37 linux-next 90cc8cf2d1ab 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/18 04:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/17 10:43 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/17 02:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 04201c06 .config console log report info ci2-upstream-usb
2020/12/16 10:18 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 649595c6 .config console log report info ci2-upstream-usb
2020/12/16 10:11 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e60366d56c6 649595c6 .config console log report info ci2-upstream-usb
2020/12/10 18:42 linux-next 14240d4c5b25 f900b48c .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/09 23:38 linux-next a9e26cb5f261 c090b4da .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.