syzbot


KMSAN: kernel-usb-infoleak in usbhid_raw_request

Status: upstream: reported on 2025/07/02 14:02
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+fbe9fff1374eefadffb9@syzkaller.appspotmail.com
First crash: 5d01h, last: 2h12m
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [usb?] KMSAN: kernel-usb-infoleak in usbhid_raw_request 0 (1) 2025/07/02 14:02
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in _copy_to_iter (8) mm C 21180 756d 850d 22/29 fixed on 2023/06/08 14:41
upstream KMSAN: kernel-infoleak in kernfs_fop_read_iter kernfs 2 736d 738d 0/29 auto-obsoleted due to no activity on 2023/09/26 06:08
upstream KASAN: slab-out-of-bounds Read in ntfs_trim_fs ntfs3 C done 204 912d 1010d 22/29 fixed on 2023/02/24 13:50

Sample crash report:
=====================================================
BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x5a1/0x2630 drivers/usb/core/urb.c:430
 usb_submit_urb+0x5a1/0x2630 drivers/usb/core/urb.c:430
 usb_start_wait_urb+0xc2/0x320 drivers/usb/core/message.c:59
 usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
 usb_control_msg+0x27c/0x5b0 drivers/usb/core/message.c:154
 usbhid_raw_request+0x4ab/0x690 drivers/hid/usbhid/hid-core.c:-1
 __hid_request+0x2c0/0x500 drivers/hid/hid-core.c:1989
 hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline]
 hidinput_connect+0x3bf5/0x5cc0 drivers/hid/hid-input.c:2327
 hid_connect+0x6b4/0x3440 drivers/hid/hid-core.c:2239
 hid_hw_start+0xfc/0x1e0 drivers/hid/hid-core.c:2354
 ms_probe+0x2e5/0x890 drivers/hid/hid-microsoft.c:391
 __hid_device_probe drivers/hid/hid-core.c:2724 [inline]
 hid_device_probe+0x536/0xab0 drivers/hid/hid-core.c:2761
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d1/0xd90 drivers/base/dd.c:657
 __driver_probe_device+0x268/0x380 drivers/base/dd.c:799
 driver_probe_device+0x70/0x8b0 drivers/base/dd.c:829
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:957
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:462
 __device_attach+0x3c8/0x5c0 drivers/base/dd.c:1029
 device_initial_probe+0x33/0x40 drivers/base/dd.c:1078
 bus_probe_device+0x3ba/0x5e0 drivers/base/bus.c:537
 device_add+0x12a9/0x1c10 drivers/base/core.c:3692
 hid_add_device+0x5ed/0x7b0 drivers/hid/hid-core.c:2907
 usbhid_probe+0x1fec/0x2660 drivers/hid/usbhid/hid-core.c:1435
 usb_probe_interface+0xd04/0x1310 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d1/0xd90 drivers/base/dd.c:657
 __driver_probe_device+0x268/0x380 drivers/base/dd.c:799
 driver_probe_device+0x70/0x8b0 drivers/base/dd.c:829
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:957
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:462
 __device_attach+0x3c8/0x5c0 drivers/base/dd.c:1029
 device_initial_probe+0x33/0x40 drivers/base/dd.c:1078
 bus_probe_device+0x3ba/0x5e0 drivers/base/bus.c:537
 device_add+0x12a9/0x1c10 drivers/base/core.c:3692
 usb_set_configuration+0x3493/0x3b70 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xfc/0x290 drivers/usb/core/generic.c:250
 usb_probe_device+0x38a/0x690 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d1/0xd90 drivers/base/dd.c:657
 __driver_probe_device+0x268/0x380 drivers/base/dd.c:799
 driver_probe_device+0x70/0x8b0 drivers/base/dd.c:829
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:957
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:462
 __device_attach+0x3c8/0x5c0 drivers/base/dd.c:1029
 device_initial_probe+0x33/0x40 drivers/base/dd.c:1078
 bus_probe_device+0x3ba/0x5e0 drivers/base/bus.c:537
 device_add+0x12a9/0x1c10 drivers/base/core.c:3692
 usb_new_device+0x104b/0x20c0 drivers/usb/core/hub.c:2663
 hub_port_connect drivers/usb/core/hub.c:5535 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5675 [inline]
 port_event drivers/usb/core/hub.c:5835 [inline]
 hub_event+0x5588/0x7580 drivers/usb/core/hub.c:5917
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xb8e/0x1d80 kernel/workqueue.c:3321
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3402
 kthread+0xd5c/0xf00 kernel/kthread.c:464
 ret_from_fork+0x1e0/0x310 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4154 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_node_track_caller_noprof+0x96d/0x12f0 mm/slub.c:4347
 kvasprintf+0xbd/0x200 lib/kasprintf.c:25
 kvasprintf_const+0x1df/0x370 lib/kasprintf.c:49
 kobject_set_name_vargs+0x87/0x2f0 lib/kobject.c:274
 kobject_add_varg lib/kobject.c:368 [inline]
 kobject_init_and_add+0x2f4/0x4e0 lib/kobject.c:457
 rx_queue_add_kobject net/core/net-sysfs.c:1239 [inline]
 net_rx_queue_update_kobjects+0x314/0xd40 net/core/net-sysfs.c:1301
 register_queue_kobjects net/core/net-sysfs.c:2093 [inline]
 netdev_register_kobject+0x2bc/0x4f0 net/core/net-sysfs.c:2340
 register_netdevice+0x1b41/0x25d0 net/core/dev.c:11105
 register_netdev+0xa3/0xe0 net/core/dev.c:11221
 loopback_net_init+0xce/0x2f0 drivers/net/loopback.c:218
 ops_init+0x2b3/0x9f0 net/core/net_namespace.c:138
 setup_net+0x275/0x900 net/core/net_namespace.c:442
 copy_net_ns+0x49d/0xba0 net/core/net_namespace.c:574
 create_new_namespaces+0x72c/0xce0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x179/0x2e0 kernel/nsproxy.c:218
 ksys_unshare+0x8fd/0x12b0 kernel/fork.c:3121
 __do_sys_unshare kernel/fork.c:3192 [inline]
 __se_sys_unshare kernel/fork.c:3190 [inline]
 __x64_sys_unshare+0x47/0x70 kernel/fork.c:3190
 x64_sys_call+0x398b/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 52-54 of 65535 are uninitialized
Memory access of size 65535 starts at ffff88802dbd34e1

CPU: 0 UID: 0 PID: 1550 Comm: kworker/0:2 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event

=====================================================

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/03 13:06 upstream b4911fb0b060 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 13:06 upstream b4911fb0b060 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 05:08 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 05:08 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 15:41 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 15:41 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 15:40 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 15:40 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 06:23 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 06:23 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 06:16 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/03 06:15 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/02 06:16 upstream 66701750d556 ffe4b334 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/02 06:15 upstream 66701750d556 ffe4b334 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 16:24 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 16:18 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/07/01 16:11 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/06/28 13:59 upstream aaf724ed6926 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
2025/06/28 13:57 upstream aaf724ed6926 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-usb-infoleak in usbhid_raw_request
* Struck through repros no longer work on HEAD.