UBSAN: array-index-out-of-bounds in uea_bind

Status: upstream: reported C repro on 2026/08/01 00:44
Subsystems: usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com
First crash: 3d14h, last: 2d15h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
599b5488 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ UBSAN: array-index-out-of-bounds in uea_bind 2026/07/31 06:46 2026/07/31 06:46 2026/07/31 07:18 aaffb173

			
		
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind() 1 (1) 2026/08/02 06:29
[syzbot] [usb?] UBSAN: array-index-out-of-bounds in uea_bind 0 (2) 2026/08/02 04:46
Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/08/02 04:46 27m subasris1210@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 5d5fd841c34649f1b09220fe58e59dffd61c447d OK log

Sample crash report:
usb 5-1: reset high-speed USB device number 6 using dummy_hcd
usb 5-1: device descriptor read/64, error -71
usb 5-1: reset high-speed USB device number 6 using dummy_hcd
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/usb/atm/ueagle-atm.c:2466:28
index 4 is out of range for type 'bool [4]'
CPU: 2 UID: 0 PID: 847 Comm: kworker/2:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 uea_bind+0x1014/0x1380 drivers/usb/atm/ueagle-atm.c:2466
 usbatm_usb_probe+0x378/0x1b50 drivers/usb/atm/usbatm.c:1058
 uea_probe+0x194/0x570 drivers/usb/atm/ueagle-atm.c:2597
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3772
 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---

Crashes (82):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/31 06:46 upstream 3708dd948844 aaffb173 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in uea_bind
2026/07/31 12:07 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5d5fd841c346 aaffb173 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-usb UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:24 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:15 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:07 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:07 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:06 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:06 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:05 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:05 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:04 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:04 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:04 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:03 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:03 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:02 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:01 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:01 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:00 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 05:00 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:56 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:56 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:56 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:55 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:55 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:54 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:54 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:54 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:54 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:53 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:52 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:52 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:52 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:51 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:50 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:50 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:50 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:49 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:49 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:49 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:48 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:48 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
2026/08/01 04:48 upstream a2cf4ef33184 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in uea_bind
* Struck through repros no longer work on HEAD.