Re: [syzbot] [greybus?] [usb?] KASAN: slab-out-of-bounds Write in gb_operation_message_alloc

[Johan Hovold]

On Thu, Aug 27, 2026 at 11:51:31AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    45c13f3f9e3b Merge tag 'hwlock-v7.3' of git://git.kernel.o..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ab5299580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=9b0fc292fc5639c
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=137a3579580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=173ed625580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ac6556827073/disk-45c13f3f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/01ff014f18d2/vmlinux-45c13f3f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/77e9c6302a14/bzImage-45c13f3f.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2fd6aefc361af86911d5@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> usb 4-1: invalid cport id 160 received
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in gb_operation_message_init drivers/greybus/operation.c:341 [inline]
> BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
> Write of size 2 at addr ffff888100b7e582 by task syz.3.17/3979
> 
> CPU: 1 UID: 0 PID: 3979 Comm: syz.3.17 Not tainted syzkaller #0 PREEMPT(lazy) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <IRQ>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
>  print_address_description mm/kasan/report.c:378 [inline]
>  print_report+0x13d/0x4b0 mm/kasan/report.c:482
>  kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
>  gb_operation_message_init drivers/greybus/operation.c:341 [inline]
>  gb_operation_message_alloc+0x26e/0x2c0 drivers/greybus/operation.c:385
>  gb_operation_create_common+0x9f/0x710 drivers/greybus/operation.c:532
>  gb_operation_create_incoming drivers/greybus/operation.c:644 [inline]
>  gb_connection_recv_request drivers/greybus/operation.c:926 [inline]
>  gb_connection_recv+0x1dc/0x1050 drivers/greybus/operation.c:1063
>  greybus_data_rcvd+0x244/0x600 drivers/greybus/connection.c:89

This appears to be the same issue being fixed here:

	https://lore.kernel.org/all/tencent_4F423FBD3FCE6066A8538BB3CFBCB0C41E09@xxxxxx/

Hopefully, Yang will produce a non-corrupt patch soon.

Johan