[BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/

  BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
  Read of size 4 at addr ffff88810e9061c8 by task repro/9505
  Call Trace:
   ci_hdrc_add_device+0xb76/0xd10
   ci_hdrc_usb2_probe+0x22d/0x370
   platform_probe+0xf9/0x190
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   device_driver_attach+0xe0/0x1d0
   bind_store+0x1d0/0x220
   kernfs_fop_write_iter+0x3af/0x540
   vfs_write+0x61d/0xb90
   ksys_write+0x150/0x270

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Greg Kroah-Hartman]

On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/
> 
>   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
>   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
>   Call Trace:
>    ci_hdrc_add_device+0xb76/0xd10
>    ci_hdrc_usb2_probe+0x22d/0x370
>    platform_probe+0xf9/0x190
>    really_probe+0x267/0xaf0
>    __driver_probe_device+0x1e2/0x350
>    device_driver_attach+0xe0/0x1d0
>    bind_store+0x1d0/0x220
>    kernfs_fop_write_iter+0x3af/0x540
>    vfs_write+0x61d/0xb90
>    ksys_write+0x150/0x270
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Please send such a patch.

But again, stop messing around with root-only sysfs files without
understanding that you get to keep the broken pieces of the kernel if
you touch them :)

thanks,

greg k-h

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Greg Kroah-Hartman]

On Fri, Aug 28, 2026 at 08:01:19AM +0200, Greg Kroah-Hartman wrote:
> On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> > Hello,
> > 
> > As part of the kernel research at ASU's SEFCOM
> > lab, we hit the crash below. Crash reports can be found here:
> > 
> >   https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/
> > 
> >   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
> >   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
> >   Call Trace:
> >    ci_hdrc_add_device+0xb76/0xd10
> >    ci_hdrc_usb2_probe+0x22d/0x370
> >    platform_probe+0xf9/0x190
> >    really_probe+0x267/0xaf0
> >    __driver_probe_device+0x1e2/0x350
> >    device_driver_attach+0xe0/0x1d0
> >    bind_store+0x1d0/0x220
> >    kernfs_fop_write_iter+0x3af/0x540
> >    vfs_write+0x61d/0xb90
> >    ksys_write+0x150/0x270
> > 
> > Our reproducer.c is available upon request.
> > 
> > Happy to test a patch if that would help.
> 
> Please send such a patch.
> 
> But again, stop messing around with root-only sysfs files without
> understanding that you get to keep the broken pieces of the kernel if
> you touch them :)

To be honest, all of these "reports" look like you set a fuzzer loose on
the kernel, while running as root, and are surprised that things broke.
You should be more surprised that you actually only got a few crash
traces and that your whole system wasn't randomly corrupted and
permanently destroyed :)

Perhaps you might want to look into the "guardrails" that other more
mature tools like syzbot has in place to not go and do things that are
"obviously wrong" and add that to your llm "harness"?

good luck with the research.

greg k-h

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Michal Pecio]

On Fri, 28 Aug 2026 08:01:19 +0200, Greg Kroah-Hartman wrote:
> On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> >
> >   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
> >   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
> >   Call Trace:
> >    ci_hdrc_add_device+0xb76/0xd10
> >    ci_hdrc_usb2_probe+0x22d/0x370
> >    platform_probe+0xf9/0x190
> >    really_probe+0x267/0xaf0
> >    __driver_probe_device+0x1e2/0x350
> >    device_driver_attach+0xe0/0x1d0
> >    bind_store+0x1d0/0x220
> >    kernfs_fop_write_iter+0x3af/0x540
> >    vfs_write+0x61d/0xb90
> >    ksys_write+0x150/0x270

This would be more useful with decoded line numbers, like Syzbot does.

But it looks like you don't actually have this hardware and are trying
to bind the driver to a different device by means of 'driver_override'
or 'new_id'. Many others monkeying with this recently, hence...

> But again, stop messing around with root-only sysfs files without
> understanding that you get to keep the broken pieces of the kernel
> if you touch them :)
> 
> thanks,
> 
> greg k-h

And for the record, I still think that focusing on bind/unbind is
misguided because this interface can be used to trigger actual bugs
which would otherwise need connection or reboot cycles to trigger,
and they would still trigger after sufficient wasted time, with same
stack but 'init_module' or 'usb_new_device' instead of 'bind_store'.

Conversely, this splat could as well be caused by a PCI device with
spoofed IDs (think VM). Possibly even by adding a new ID and running
PCI rescan, so no custom VM needed. Too lazy to try it now...

Actual issue is that the kernel doesn't care about working around
platform/pci/insert/other/subsystems anomalies which don't actually
exist in the field, and I think that's what should be communicated.

Regards,
Michal

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Greg Kroah-Hartman]

On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/
> 
>   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
>   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
>   Call Trace:
>    ci_hdrc_add_device+0xb76/0xd10
>    ci_hdrc_usb2_probe+0x22d/0x370
>    platform_probe+0xf9/0x190
>    really_probe+0x267/0xaf0
>    __driver_probe_device+0x1e2/0x350
>    device_driver_attach+0xe0/0x1d0
>    bind_store+0x1d0/0x220
>    kernfs_fop_write_iter+0x3af/0x540
>    vfs_write+0x61d/0xb90
>    ksys_write+0x150/0x270
> 
> Our reproducer.c is available upon request.

Why are these still being sent?

confused,

greg k-h

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Farhad Alemi]

Greg,

We are not sending more emails after receiving your earlier set of
messages. These are all some classifier backlogs.

On Fri, Aug 28, 2026 at 4:01 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> > Hello,
> >
> > As part of the kernel research at ASU's SEFCOM
> > lab, we hit the crash below. Crash reports can be found here:
> >
> >   https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/
> >
> >   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
> >   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
> >   Call Trace:
> >    ci_hdrc_add_device+0xb76/0xd10
> >    ci_hdrc_usb2_probe+0x22d/0x370
> >    platform_probe+0xf9/0x190
> >    really_probe+0x267/0xaf0
> >    __driver_probe_device+0x1e2/0x350
> >    device_driver_attach+0xe0/0x1d0
> >    bind_store+0x1d0/0x220
> >    kernfs_fop_write_iter+0x3af/0x540
> >    vfs_write+0x61d/0xb90
> >    ksys_write+0x150/0x270
> >
> > Our reproducer.c is available upon request.
>
> Why are these still being sent?
>
> confused,
>
> greg k-h

Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Greg Kroah-Hartman]

On Fri, Aug 28, 2026 at 04:18:32AM -0700, Farhad Alemi wrote:
> Greg,
> 
> We are not sending more emails after receiving your earlier set of
> messages. These are all some classifier backlogs.

Ah, sorry about that, some email systems are slow :)