linux-kernel - Re: (subset) [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in s32ton (2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <gdbdodhtc2ibzfzjtniawzamz7iqhcdhyiubviy27vypszfhc3@cypc7pfbib6z>
Date: Wed, 23 Jul 2025 11:36:20 +0200
From: Benjamin Tissoires <bentiss@...nel.org>
To: syzbot <syzbot+b63d677d63bcac06cf90@...kaller.appspotmail.com>, 
	Alan Stern <stern@...land.harvard.edu>
Cc: jikos@...nel.org, linux-input@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: (subset) [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in
 s32ton (2)

On Jul 18 2025, Benjamin Tissoires wrote:
> On Tue, 15 Jul 2025 15:29:25 -0400, Alan Stern wrote:
> > On Mon, Jul 14, 2025 at 10:10:32AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    b4b4dbfa96de media: stk1160: use usb_alloc_noncoherent/usb..
> > > git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=15a830f0580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=28729dff5d03ad1
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=b63d677d63bcac06cf90
> > > compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1614418c580000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1257dd82580000
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/7301552ad828/disk-b4b4dbfa.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/c559b38fa1b6/vmlinux-b4b4dbfa.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/9c1da8b2a83f/bzImage-b4b4dbfa.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+b63d677d63bcac06cf90@...kaller.appspotmail.com
> > >
> > > usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
> > > usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
> > > usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
> > > usb 4-1: config 0 descriptor??
> > > microsoft 0003:045E:07DA.0001: ignoring exceeding usage max
> > > microsoft 0003:045E:07DA.0001: unsupported Resolution Multiplier 0
> > > ------------[ cut here ]------------
> > > UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:69:16
> > > shift exponent 4294967295 is too large for 32-bit type 'int'
> > > CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.16.0-rc4-syzkaller-00314-gb4b4dbfa96de #0 PREEMPT(voluntary)
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> > > Workqueue: usb_hub_wq hub_event
> > > Call Trace:
> > >  <TASK>
> > >  __dump_stack lib/dump_stack.c:94 [inline]
> > >  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
> > >  ubsan_epilogue lib/ubsan.c:233 [inline]
> > >  __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494
> > >  s32ton.cold+0x37/0x9c drivers/hid/hid-core.c:69
> > >  hid_output_field drivers/hid/hid-core.c:1841 [inline]
> > >  hid_output_report+0x36f/0x4a0 drivers/hid/hid-core.c:1874
> > >  __hid_request+0x1e0/0x3c0 drivers/hid/hid-core.c:1987
> > >  hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
> > >  hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327
> > 
> > [...]
> 
> Applied to hid/hid.git (for-6.17/core), thanks!
> 
> [1/1] HID: core: Reject report fields with a size or count of 0
>       https://git.kernel.org/hid/hid/c/bcf266ca2779

FTR, the patch has been dropped from for-next, it broke existing
devices. A better patch is being worked on.

Cheers,
Benjamin