UBSAN: shift-out-of-bounds in s32ton (3)

Status: upstream: reported C repro on 2026/10/10 05:23
Subsystems: input usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
First crash: 4d16h, last: 4d11h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
9027780b assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ UBSAN: shift-out-of-bounds in s32ton (3) 2026/10/07 01:43 2026/10/07 01:43 2026/10/07 02:12 f7710056
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] HID: core: Fix out-of-bounds left shift by 32 in s32ton() 1 (1) 2026/10/10 17:44
[syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in s32ton (3) 1 (3) 2026/10/10 14:18
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in s32ton usb input -1 18 593d 698d 0/29 auto-obsoleted due to no activity on 2025/05/23 12:14
upstream UBSAN: shift-out-of-bounds in s32ton (2) input usb -1 syz, C 4 446d 453d 29/29 fixed on 2025/09/04 16:57
android-6-12 UBSAN: shift-out-of-bounds in s32ton origin:upstream -1 syz, C 3 336d 453d 0/1 auto-obsoleted due to no activity on 2026/02/26 09:24
android-5-15 UBSAN: shift-out-of-bounds in s32ton -1 syz, C error 8 256d 305d 0/2 auto-obsoleted due to no activity on 2026/05/07 03:05
android-6-1 UBSAN: shift-out-of-bounds in s32ton origin:lts -1 syz, C error 3 288d 336d 0/2 auto-obsoleted due to no activity on 2026/04/05 14:08
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/10 13:49 22m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 5926a7da8789 OK job log log

Sample crash report:
usb 4-1: config 0 interface 0 has no altsetting 0
usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 4-1: config 0 descriptor??
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:80:21
shift exponent 32 is too large for 32-bit type 'int'
CPU: 1 UID: 0 PID: 780 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
 s32ton.part.0.cold+0x1b/0x26 drivers/hid/hid-core.c:80
 s32ton drivers/hid/hid-core.c:71 [inline]
 hid_output_field drivers/hid/hid-core.c:1871 [inline]
 hid_output_report+0x3c2/0x500 drivers/hid/hid-core.c:1904
 __usbhid_submit_report+0x33f/0xeb0 drivers/hid/usbhid/hid-core.c:595
 usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
 usbhid_request+0x7d/0xf0 drivers/hid/usbhid/hid-core.c:1303
 hid_hw_request+0x75/0xc0 drivers/hid/hid-core.c:2531
 dr_input_configured+0x62c/0x770 drivers/hid/hid-dr.c:124
 hidinput_connect+0xf59/0x2ca0 drivers/hid/hid-input.c:2414
 hid_connect+0x1330/0x1790 drivers/hid/hid-core.c:2323
 hid_hw_start+0xaa/0x140 drivers/hid/hid-core.c:2436
 __hid_device_probe drivers/hid/hid-core.c:2843 [inline]
 hid_device_probe+0x703/0x850 drivers/hid/hid-core.c:2878
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 hid_add_device+0x2bf/0x440 drivers/hid/hid-core.c:3065
 usbhid_probe+0xa64/0x10b0 drivers/hid/usbhid/hid-core.c:1452
 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_set_configuration+0xd97/0x1dc0 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2713
 usb_new_device drivers/usb/core/hub.c:5838 [inline]
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5971
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/06 10:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5926a7da8789 f7710056 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: shift-out-of-bounds in s32ton
2026/10/06 08:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5926a7da8789 f7710056 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: shift-out-of-bounds in s32ton
2026/10/06 07:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5926a7da8789 f7710056 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: shift-out-of-bounds in s32ton
2026/10/06 06:18 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5926a7da8789 f7710056 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: shift-out-of-bounds in s32ton
2026/10/06 05:12 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5926a7da8789 f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: shift-out-of-bounds in s32ton
* Struck through repros no longer work on HEAD.