Re: [BUG] ci_hdrc_add_device -- KASAN slab-out-of-bounds reading a FOREIGN device's platform_data

[Greg Kroah-Hartman]

On Thu, Aug 27, 2026 at 10:34:56PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/150-usb-chipidea-foreign-platform_data-oob/
> 
>   BUG: KASAN: slab-out-of-bounds in ci_hdrc_add_device+0xb76/0xd10
>   Read of size 4 at addr ffff88810e9061c8 by task repro/9505
>   Call Trace:
>    ci_hdrc_add_device+0xb76/0xd10
>    ci_hdrc_usb2_probe+0x22d/0x370
>    platform_probe+0xf9/0x190
>    really_probe+0x267/0xaf0
>    __driver_probe_device+0x1e2/0x350
>    device_driver_attach+0xe0/0x1d0
>    bind_store+0x1d0/0x220
>    kernfs_fop_write_iter+0x3af/0x540
>    vfs_write+0x61d/0xb90
>    ksys_write+0x150/0x270
> 
> Our reproducer.c is available upon request.

Why are these still being sent?

confused,

greg k-h