On Mon, Jul 14, 2025 at 10:10:32AM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: b4b4dbfa96de media: stk1160: use usb_alloc_noncoherent/usb.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=15a830f0580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=28729dff5d03ad1 > dashboard link: https://syzkaller.appspot.com/bug?extid=b63d677d63bcac06cf90 > compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1614418c580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1257dd82580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/7301552ad828/disk-b4b4dbfa.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/c559b38fa1b6/vmlinux-b4b4dbfa.xz > kernel image: https://storage.googleapis.com/syzbot-assets/9c1da8b2a83f/bzImage-b4b4dbfa.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+b63d677d63bcac06cf90@xxxxxxxxxxxxxxxxxxxxxxxxx > > usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 > usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 > usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 > usb 4-1: config 0 descriptor?? > microsoft 0003:045E:07DA.0001: ignoring exceeding usage max > microsoft 0003:045E:07DA.0001: unsupported Resolution Multiplier 0 > ------------[ cut here ]------------ > UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:69:16 > shift exponent 4294967295 is too large for 32-bit type 'int' > CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.16.0-rc4-syzkaller-00314-gb4b4dbfa96de #0 PREEMPT(voluntary) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 > Workqueue: usb_hub_wq hub_event > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 > ubsan_epilogue lib/ubsan.c:233 [inline] > __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 > s32ton.cold+0x37/0x9c drivers/hid/hid-core.c:69 > hid_output_field drivers/hid/hid-core.c:1841 [inline] > hid_output_report+0x36f/0x4a0 drivers/hid/hid-core.c:1874 > __hid_request+0x1e0/0x3c0 drivers/hid/hid-core.c:1987 > hidinput_change_resolution_multipliers drivers/hid/hid-input.c:1950 [inline] > hidinput_connect+0x1ada/0x2bd0 drivers/hid/hid-input.c:2327 #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git c2ca42f190b6
