Re: UBSAN: shift-out-of-bounds in option_probe

[Johan Hovold]

On Tue, Dec 08, 2020 at 11:33:11PM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    15ac8fdb Add linux-next specific files for 20201207
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=17dc6adf500000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3696b8138207d24d
> dashboard link: https://syzkaller.appspot.com/bug?extid=8881b478dad0a7971f79
> compiler:       gcc (GCC) 10.1.0-syz 20200507
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12e89613500000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17993623500000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8881b478dad0a7971f79@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> usb 1-1: config 0 interface 109 has no altsetting 0
> usb 1-1: New USB device found, idVendor=12d1, idProduct=02cb, bcdDevice= 1.fb
> usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
> usb 1-1: config 0 descriptor??
> ================================================================================
> UBSAN: shift-out-of-bounds in drivers/usb/serial/option.c:2120:21
> shift exponent 109 is too large for 64-bit type 'long unsigned int'

Ok, we need to add a sanity check against large interface numbers before
the device-flag tests. I'll cook something up.

Johan