UBSAN: shift-out-of-bounds in snto32 (2)

Status: auto-obsoleted due to no activity on 2023/04/21 11:23
Subsystems: input usb
[Documentation on labels]
Reported-by: syzbot+fd5aff28563665022354@syzkaller.appspotmail.com
First crash: 1426d, last: 1380d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: UBSAN: shift-out-of-bounds in snto32 (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit ec61b41918587be530398b0d1c9a0d16619397e5
Author: ZhangPeng <zhangpeng362@huawei.com>
Date: Wed Nov 16 07:14:28 2022 +0000

  HID: core: fix shift-out-of-bounds in hid_report_raw_event

  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] UBSAN: shift-out-of-bounds in snto32 (2) 0 (1) 2022/09/03 15:50
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in snto32 input usb -1 C error 58 1978d 2051d 20/29 fixed on 2021/04/09 19:46
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2023/04/21 10:56 26m retest repro linux-next OK log
2023/04/13 05:11 19m retest repro upstream OK log
2023/04/13 04:11 24m retest repro https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing OK log

Sample crash report:
microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) > 32! (swapper/1)
================================================================================
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20
shift exponent 127 is too large for 32-bit type 'int'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc3-syzkaller-00107-g42e66b1cc3a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x50 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x187 lib/ubsan.c:322
 snto32 drivers/hid/hid-core.c:1323 [inline]
 snto32.cold+0x19/0x48 drivers/hid/hid-core.c:1313
 hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline]
 hid_process_report drivers/hid/hid-core.c:1665 [inline]
 hid_report_raw_event+0x88b/0x1280 drivers/hid/hid-core.c:1998
 hid_input_report+0x360/0x4c0 drivers/hid/hid-core.c:2065
 hid_irq_in+0x50e/0x690 drivers/hid/usbhid/hid-core.c:284
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1671
 usb_hcd_giveback_urb+0x380/0x430 drivers/usb/core/hcd.c:1754
 dummy_timer+0x11ff/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1d3/0x9c6 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt+0x6f/0xb0 drivers/acpi/processor_idle.c:113
Code: f7 84 db 74 06 5b e9 d0 7d f9 f7 e8 cb 7d f9 f7 e8 f6 f4 ff f7 eb 0c e8 bf 7d f9 f7 0f 00 2d 68 33 d2 00 e8 b3 7d f9 f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 7e 7a f9 f7 48 85 db
RSP: 0018:ffffc90000177d20 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888011a89d80 RSI: ffffffff89828c7d RDI: 0000000000000000
RBP: ffff888017821064 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000001 R14: ffff888017821000 R15: ffff8881462ec804
 acpi_idle_do_entry drivers/acpi/processor_idle.c:555 [inline]
 acpi_idle_enter+0x524/0x6a0 drivers/acpi/processor_idle.c:692
 cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239
 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x3e8/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	f7 84 db 74 06 5b e9 	testl  $0xf7f97dd0,-0x16a4f98c(%rbx,%rbx,8)
   7:	d0 7d f9 f7
   b:	e8 cb 7d f9 f7       	callq  0xf7f97ddb
  10:	e8 f6 f4 ff f7       	callq  0xf7fff50b
  15:	eb 0c                	jmp    0x23
  17:	e8 bf 7d f9 f7       	callq  0xf7f97ddb
  1c:	0f 00 2d 68 33 d2 00 	verw   0xd23368(%rip)        # 0xd2338b
  23:	e8 b3 7d f9 f7       	callq  0xf7f97ddb
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	9c                   	pushfq <-- trapping instruction
  2b:	5b                   	pop    %rbx
  2c:	81 e3 00 02 00 00    	and    $0x200,%ebx
  32:	fa                   	cli
  33:	31 ff                	xor    %edi,%edi
  35:	48 89 de             	mov    %rbx,%rsi
  38:	e8 7e 7a f9 f7       	callq  0xf7f97abb
  3d:	48 85 db             	test   %rbx,%rbx

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/09/02 11:56 upstream 42e66b1cc3a0 a805568e .config strace log report syz C ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in snto32
2022/08/30 19:12 upstream dcf8e5633e2e 4a380809 .config strace log report syz C ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in snto32
2022/10/15 16:38 linux-next aaa11ce2ffc8 67cb024c .config strace log report syz C [disk image] [vmlinux] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in snto32
2022/08/30 16:38 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ffcf9c5700e4 4a380809 .config console log report syz C [disk image] [vmlinux] ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
2022/08/30 15:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ffcf9c5700e4 4a380809 .config console log report info [disk image] [vmlinux] ci2-upstream-usb UBSAN: shift-out-of-bounds in snto32
* Struck through repros no longer work on HEAD.