syzbot


KMSAN: uninit-value in iforce_init_device (2)

Status: fixed on 2023/02/24 13:50
Subsystems: input
[Documentation on labels]
Reported-by: syzbot+4dd880c1184280378821@syzkaller.appspotmail.com
Fix commit: b8ebf250997c Input: iforce - invert valid length check when fetching device IDs
First crash: 560d, last: 555d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] Input: iforce - invert valid length check when fetching device IDs 2 (2) 2022/11/07 18:29
[syzbot] KMSAN: uninit-value in iforce_init_device (2) 0 (1) 2022/11/07 09:43
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in iforce_init_device input 1 673d 673d 0/26 auto-closed as invalid on 2022/09/14 12:18

Sample crash report:
iforce 1-1:0.0: usb_submit_urb failed: -71
iforce 1-1:0.0: usb_submit_urb failed: -71
iforce 1-1:0.0: usb_submit_urb failed: -71
=====================================================
BUG: KMSAN: uninit-value in iforce_init_device+0x1bd5/0x2010 drivers/input/joystick/iforce/iforce-main.c:297
 iforce_init_device+0x1bd5/0x2010 drivers/input/joystick/iforce/iforce-main.c:297
 iforce_usb_probe+0xc86/0x11c0 drivers/input/joystick/iforce/iforce-usb.c:238
 usb_probe_interface+0xc4b/0x11f0 drivers/usb/core/driver.c:396
 really_probe+0x506/0x1000 drivers/base/dd.c:639
 __driver_probe_device+0x2fa/0x3d0 drivers/base/dd.c:778
 driver_probe_device+0x72/0x7a0 drivers/base/dd.c:808
 __device_attach_driver+0x548/0x8e0 drivers/base/dd.c:936
 bus_for_each_drv+0x1fc/0x360 drivers/base/bus.c:427
 __device_attach+0x42a/0x720 drivers/base/dd.c:1008
 device_initial_probe+0x2e/0x40 drivers/base/dd.c:1057
 bus_probe_device+0x13c/0x3b0 drivers/base/bus.c:487
 device_add+0x1d4b/0x26c0 drivers/base/core.c:3517
 usb_set_configuration+0x30f8/0x37e0 drivers/usb/core/message.c:2170
 usb_generic_driver_probe+0x105/0x290 drivers/usb/core/generic.c:238
 usb_probe_device+0x288/0x490 drivers/usb/core/driver.c:293
 really_probe+0x506/0x1000 drivers/base/dd.c:639
 __driver_probe_device+0x2fa/0x3d0 drivers/base/dd.c:778
 driver_probe_device+0x72/0x7a0 drivers/base/dd.c:808
 __device_attach_driver+0x548/0x8e0 drivers/base/dd.c:936
 bus_for_each_drv+0x1fc/0x360 drivers/base/bus.c:427
 __device_attach+0x42a/0x720 drivers/base/dd.c:1008
 device_initial_probe+0x2e/0x40 drivers/base/dd.c:1057
 bus_probe_device+0x13c/0x3b0 drivers/base/bus.c:487
 device_add+0x1d4b/0x26c0 drivers/base/core.c:3517
 usb_new_device+0x17ac/0x2370 drivers/usb/core/hub.c:2573
 hub_port_connect drivers/usb/core/hub.c:5353 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
 port_event drivers/usb/core/hub.c:5653 [inline]
 hub_event+0x5589/0x8080 drivers/usb/core/hub.c:5735
 process_one_work+0xb27/0x13e0 kernel/workqueue.c:2289
 worker_thread+0x1076/0x1d60 kernel/workqueue.c:2436
 kthread+0x31b/0x430 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

Local variable buf created at:
 iforce_init_device+0x5a/0x2010 drivers/input/joystick/iforce/iforce-main.c:217
 iforce_usb_probe+0xc86/0x11c0 drivers/input/joystick/iforce/iforce-usb.c:238

CPU: 0 PID: 15409 Comm: kworker/0:2 Not tainted 6.0.0-rc5-syzkaller-48543-g968c2729e576 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: usb_hub_wq hub_event
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/12 00:56 https://github.com/google/kmsan.git master 968c2729e576 1353c374 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iforce_init_device
2022/10/09 08:44 https://github.com/google/kmsan.git master 968c2729e576 aea5da89 .config console log report info [disk image] [vmlinux] ci-upstream-kmsan-gce KMSAN: uninit-value in iforce_init_device
2022/10/06 17:01 https://github.com/google/kmsan.git master 968c2729e576 131b38ac .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iforce_init_device
* Struck through repros no longer work on HEAD.