Re: [syzbot] [input?] KASAN: null-ptr-deref Read in input_event

[Hillf Danton]

On Sun, 05 Jan 2025 00:31:21 -0800
> syzbot found the following issue on:
> 
> HEAD commit:    f097a36ef88d dt-bindings: usb: qcom,dwc3: Add QCS615 to US..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17e2a8b0580000

#syz test

--- x/include/linux/input.h
+++ y/include/linux/input.h
@@ -140,17 +140,17 @@ struct input_dev {
 	const char *uniq;
 	struct input_id id;
 
-	unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
+	unsigned long propbit[1+ BITS_TO_LONGS(INPUT_PROP_CNT)];
 
-	unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
-	unsigned long keybit[BITS_TO_LONGS(KEY_CNT)];
-	unsigned long relbit[BITS_TO_LONGS(REL_CNT)];
-	unsigned long absbit[BITS_TO_LONGS(ABS_CNT)];
-	unsigned long mscbit[BITS_TO_LONGS(MSC_CNT)];
-	unsigned long ledbit[BITS_TO_LONGS(LED_CNT)];
-	unsigned long sndbit[BITS_TO_LONGS(SND_CNT)];
-	unsigned long ffbit[BITS_TO_LONGS(FF_CNT)];
-	unsigned long swbit[BITS_TO_LONGS(SW_CNT)];
+	unsigned long evbit[1+ BITS_TO_LONGS(EV_CNT)];
+	unsigned long keybit[1+ BITS_TO_LONGS(KEY_CNT)];
+	unsigned long relbit[1+ BITS_TO_LONGS(REL_CNT)];
+	unsigned long absbit[1+ BITS_TO_LONGS(ABS_CNT)];
+	unsigned long mscbit[1+ BITS_TO_LONGS(MSC_CNT)];
+	unsigned long ledbit[1+ BITS_TO_LONGS(LED_CNT)];
+	unsigned long sndbit[1+ BITS_TO_LONGS(SND_CNT)];
+	unsigned long ffbit[1+ BITS_TO_LONGS(FF_CNT)];
+	unsigned long swbit[1+ BITS_TO_LONGS(SW_CNT)];
 
 	unsigned int hint_events_per_packet;
 
@@ -177,10 +177,10 @@ struct input_dev {
 
 	struct input_absinfo *absinfo;
 
-	unsigned long key[BITS_TO_LONGS(KEY_CNT)];
-	unsigned long led[BITS_TO_LONGS(LED_CNT)];
-	unsigned long snd[BITS_TO_LONGS(SND_CNT)];
-	unsigned long sw[BITS_TO_LONGS(SW_CNT)];
+	unsigned long key[1+ BITS_TO_LONGS(KEY_CNT)];
+	unsigned long led[1+ BITS_TO_LONGS(LED_CNT)];
+	unsigned long snd[1+ BITS_TO_LONGS(SND_CNT)];
+	unsigned long sw[1+ BITS_TO_LONGS(SW_CNT)];
 
 	int (*open)(struct input_dev *dev);
 	void (*close)(struct input_dev *dev);
--