From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+fddd3aa6dfcfe50c760d@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [input?] KASAN: null-ptr-deref Read in input_event
Date: Mon, 6 Jan 2025 18:49:47 +0800 [thread overview]
Message-ID: <20250106104948.1404-1-hdanton@sina.com> (raw)
In-Reply-To: <677a4359.050a0220.380ff0.000d.GAE@google.com>
On Sun, 05 Jan 2025 00:31:21 -0800
> syzbot found the following issue on:
>
> HEAD commit: f097a36ef88d dt-bindings: usb: qcom,dwc3: Add QCS615 to US..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e2a8b0580000
#syz test
--- x/include/linux/input.h
+++ y/include/linux/input.h
@@ -140,17 +140,17 @@ struct input_dev {
const char *uniq;
struct input_id id;
- unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
+ unsigned long propbit[1+ BITS_TO_LONGS(INPUT_PROP_CNT)];
- unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
- unsigned long keybit[BITS_TO_LONGS(KEY_CNT)];
- unsigned long relbit[BITS_TO_LONGS(REL_CNT)];
- unsigned long absbit[BITS_TO_LONGS(ABS_CNT)];
- unsigned long mscbit[BITS_TO_LONGS(MSC_CNT)];
- unsigned long ledbit[BITS_TO_LONGS(LED_CNT)];
- unsigned long sndbit[BITS_TO_LONGS(SND_CNT)];
- unsigned long ffbit[BITS_TO_LONGS(FF_CNT)];
- unsigned long swbit[BITS_TO_LONGS(SW_CNT)];
+ unsigned long evbit[1+ BITS_TO_LONGS(EV_CNT)];
+ unsigned long keybit[1+ BITS_TO_LONGS(KEY_CNT)];
+ unsigned long relbit[1+ BITS_TO_LONGS(REL_CNT)];
+ unsigned long absbit[1+ BITS_TO_LONGS(ABS_CNT)];
+ unsigned long mscbit[1+ BITS_TO_LONGS(MSC_CNT)];
+ unsigned long ledbit[1+ BITS_TO_LONGS(LED_CNT)];
+ unsigned long sndbit[1+ BITS_TO_LONGS(SND_CNT)];
+ unsigned long ffbit[1+ BITS_TO_LONGS(FF_CNT)];
+ unsigned long swbit[1+ BITS_TO_LONGS(SW_CNT)];
unsigned int hint_events_per_packet;
@@ -177,10 +177,10 @@ struct input_dev {
struct input_absinfo *absinfo;
- unsigned long key[BITS_TO_LONGS(KEY_CNT)];
- unsigned long led[BITS_TO_LONGS(LED_CNT)];
- unsigned long snd[BITS_TO_LONGS(SND_CNT)];
- unsigned long sw[BITS_TO_LONGS(SW_CNT)];
+ unsigned long key[1+ BITS_TO_LONGS(KEY_CNT)];
+ unsigned long led[1+ BITS_TO_LONGS(LED_CNT)];
+ unsigned long snd[1+ BITS_TO_LONGS(SND_CNT)];
+ unsigned long sw[1+ BITS_TO_LONGS(SW_CNT)];
int (*open)(struct input_dev *dev);
void (*close)(struct input_dev *dev);
--
next prev parent reply other threads:[~2025-01-06 10:52 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-05 8:31 syzbot
2025-01-06 10:49 ` Hillf Danton [this message]
2025-01-06 11:10 ` syzbot
2025-01-06 12:38 ` Hillf Danton
2025-01-06 13:14 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250106104948.1404-1-hdanton@sina.com \
--to=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+fddd3aa6dfcfe50c760d@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®