linux-kernel - Re: [syzbot] [input?] KASAN: null-ptr-deref Read in input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250106104948.1404-1-hdanton@sina.com>
Date: Mon,  6 Jan 2025 18:49:47 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+fddd3aa6dfcfe50c760d@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [input?] KASAN: null-ptr-deref Read in input_event

On Sun, 05 Jan 2025 00:31:21 -0800
> syzbot found the following issue on:
> 
> HEAD commit:    f097a36ef88d dt-bindings: usb: qcom,dwc3: Add QCS615 to US..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17e2a8b0580000

#syz test

--- x/include/linux/input.h
+++ y/include/linux/input.h
@@ -140,17 +140,17 @@ struct input_dev {
 	const char *uniq;
 	struct input_id id;
 
-	unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
+	unsigned long propbit[1+ BITS_TO_LONGS(INPUT_PROP_CNT)];
 
-	unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
-	unsigned long keybit[BITS_TO_LONGS(KEY_CNT)];
-	unsigned long relbit[BITS_TO_LONGS(REL_CNT)];
-	unsigned long absbit[BITS_TO_LONGS(ABS_CNT)];
-	unsigned long mscbit[BITS_TO_LONGS(MSC_CNT)];
-	unsigned long ledbit[BITS_TO_LONGS(LED_CNT)];
-	unsigned long sndbit[BITS_TO_LONGS(SND_CNT)];
-	unsigned long ffbit[BITS_TO_LONGS(FF_CNT)];
-	unsigned long swbit[BITS_TO_LONGS(SW_CNT)];
+	unsigned long evbit[1+ BITS_TO_LONGS(EV_CNT)];
+	unsigned long keybit[1+ BITS_TO_LONGS(KEY_CNT)];
+	unsigned long relbit[1+ BITS_TO_LONGS(REL_CNT)];
+	unsigned long absbit[1+ BITS_TO_LONGS(ABS_CNT)];
+	unsigned long mscbit[1+ BITS_TO_LONGS(MSC_CNT)];
+	unsigned long ledbit[1+ BITS_TO_LONGS(LED_CNT)];
+	unsigned long sndbit[1+ BITS_TO_LONGS(SND_CNT)];
+	unsigned long ffbit[1+ BITS_TO_LONGS(FF_CNT)];
+	unsigned long swbit[1+ BITS_TO_LONGS(SW_CNT)];
 
 	unsigned int hint_events_per_packet;
 
@@ -177,10 +177,10 @@ struct input_dev {
 
 	struct input_absinfo *absinfo;
 
-	unsigned long key[BITS_TO_LONGS(KEY_CNT)];
-	unsigned long led[BITS_TO_LONGS(LED_CNT)];
-	unsigned long snd[BITS_TO_LONGS(SND_CNT)];
-	unsigned long sw[BITS_TO_LONGS(SW_CNT)];
+	unsigned long key[1+ BITS_TO_LONGS(KEY_CNT)];
+	unsigned long led[1+ BITS_TO_LONGS(LED_CNT)];
+	unsigned long snd[1+ BITS_TO_LONGS(SND_CNT)];
+	unsigned long sw[1+ BITS_TO_LONGS(SW_CNT)];
 
 	int (*open)(struct input_dev *dev);
 	void (*close)(struct input_dev *dev);
--