[BUG] KASAN: slab-out-of-bounds Write in gb_hid_raw_request
From: Farhad Alemi
Date: Wed Sep 09 2026 - 21:38:25 EST
Hello,
We are reporting the following crash (reproducer and a proposed patch attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 44.000772][ T804] usb 3-1: new high-speed USB device number 2
using dummy_hcd
[ 44.163699][ T804] usb 3-1: New USB device found, idVendor=18d1,
idProduct=1eaf, bcdDevice= 1.00
[ 44.169786][ T804] usb 3-1: New USB device strings: Mfr=0,
Product=0, SerialNumber=0
[ 44.212054][ T12] greybus 1-svc: set power mode = 0
[ 44.212064][ T12] greybus 1-svc: power mode change failed on AP
to switch link: -5
[ 44.213758][ C1] greybus greybus1: 0/0:0: short response 0x94
received (8 < 9)
[ 44.215179][ T9337] greybus greybus1: 0/0:0: synchronous operation
id 0x0003 of type 0x14 failed: -90
[ 44.215216][ T9337] greybus 1-svc: failed to get rail count: -90
[ 44.234071][ T9337] greybus 1-2.2: Interface added (greybus)
[ 44.234080][ T9337] greybus 1-2.2: GMP VID=0x00000001, PID=0x00000001
[ 44.234087][ T9337] greybus 1-2.2: DDBL1 Manufacturer=0x00000126,
Product=0x00000001
[ 44.256005][ T9337] hid-generic 0000:0001:0002.0001: hidraw0:
<UNKNOWN> HID v1.11 Device [1-2.2.1 0001:0002] on
[ 44.295710][ T9495]
==================================================================
[ 44.295718][ T9495] BUG: KASAN: slab-out-of-bounds in
gb_hid_raw_request+0x29c/0x860
[ 44.295741][ T9495] Write of size 2 at addr ffff88810d471a0a by
task repro/9495
[ 44.295747][ T9495]
[ 44.295758][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.295767][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.295775][ T9495] Call Trace:
[ 44.295779][ T9495] <TASK>
[ 44.295784][ T9495] dump_stack_lvl+0xe8/0x150
[ 44.295794][ T9495] print_address_description+0x55/0x1e0
[ 44.295802][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.295809][ T9495] print_report+0x58/0x70
[ 44.295815][ T9495] kasan_report+0x117/0x150
[ 44.295826][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.295834][ T9495] kasan_check_range+0x264/0x2c0
[ 44.295843][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.295849][ T9495] __asan_memcpy+0x40/0x70
[ 44.295858][ T9495] gb_hid_raw_request+0x29c/0x860
[ 44.295865][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10
[ 44.295873][ T9495] ? __hid_hw_raw_request+0xa7/0x140
[ 44.295883][ T9495] hidraw_send_report+0x2bf/0x540
[ 44.295892][ T9495] ? bpf_lsm_file_permission+0x9/0x20
[ 44.295901][ T9495] hidraw_write+0x91/0xd0
[ 44.295908][ T9495] ? __pfx_hidraw_write+0x10/0x10
[ 44.295916][ T9495] vfs_write+0x29a/0xb90
[ 44.295924][ T9495] ? __pfx_vfs_write+0x10/0x10
[ 44.295931][ T9495] ? __fget_files+0x2a/0x420
[ 44.295939][ T9495] ? __fget_files+0x2a/0x420
[ 44.295944][ T9495] ? __fget_files+0x3a0/0x420
[ 44.295950][ T9495] ? __fget_files+0x2a/0x420
[ 44.295958][ T9495] ksys_write+0x150/0x270
[ 44.295965][ T9495] ? __pfx_ksys_write+0x10/0x10
[ 44.295973][ T9495] do_syscall_64+0x155/0x510
[ 44.295984][ T9495] ? trace_irq_disable+0x3b/0x140
[ 44.295993][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.296000][ T9495] ? clear_bhb_loop+0x30/0x80
[ 44.296007][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.296014][ T9495] RIP: 0033:0x4521d2
[ 44.296024][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 44.296032][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
[ 44.296042][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 00000000004521d2
[ 44.296046][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6
RDI: 0000000000000004
[ 44.296051][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000
R09: 0000000000000000
[ 44.296055][ T9495] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffcc5937c28
[ 44.296059][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002
R15: 00000000004cba40
[ 44.296066][ T9495] </TASK>
[ 44.296068][ T9495]
[ 44.296071][ T9495] Allocated by task 9495:
[ 44.296075][ T9495] kasan_save_track+0x3e/0x80
[ 44.296082][ T9495] __kasan_kmalloc+0x93/0xb0
[ 44.296090][ T9495] __kmalloc_noprof+0x36f/0x720
[ 44.296097][ T9495] gb_operation_message_alloc+0x8c/0x280
[ 44.296104][ T9495] gb_operation_create_common+0xa9/0x650
[ 44.296111][ T9495] gb_operation_create_flags+0xa2/0x2d0
[ 44.296117][ T9495] gb_hid_raw_request+0x1e6/0x860
[ 44.296123][ T9495] hidraw_send_report+0x2bf/0x540
[ 44.296130][ T9495] hidraw_write+0x91/0xd0
[ 44.296137][ T9495] vfs_write+0x29a/0xb90
[ 44.296142][ T9495] ksys_write+0x150/0x270
[ 44.296148][ T9495] do_syscall_64+0x155/0x510
[ 44.296156][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.296162][ T9495]
[ 44.296163][ T9495] The buggy address belongs to the object at
ffff88810d471a00
[ 44.296163][ T9495] which belongs to the cache kmalloc-16 of size 16
[ 44.296170][ T9495] The buggy address is located 10 bytes inside of
[ 44.296170][ T9495] allocated 11-byte region [ffff88810d471a00,
ffff88810d471a0b)
[ 44.296177][ T9495]
[ 44.296179][ T9495] The buggy address belongs to the physical page:
[ 44.296186][ T9495] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x10d471
[ 44.296193][ T9495] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[ 44.296202][ T9495] page_type: f5(slab)
[ 44.296212][ T9495] raw: 057ff00000000000 ffff88801b041640
dead000000000100 dead000000000122
[ 44.296217][ T9495] raw: 0000000000000000 0000000000800080
00000000f5000000 0000000000000000
[ 44.296220][ T9495] page dumped because: kasan: bad access detected
[ 44.296226][ T9495] page_owner tracks the page as allocated
[ 44.296229][ T9495] page last allocated via order 0, migratetype
Unmovable, gfp_mask
0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 1, tgid 1 (swapper/0), ts 3657058998
[ 44.296240][ T9495] post_alloc_hook+0x1f9/0x250
[ 44.296247][ T9495] get_page_from_freelist+0x235a/0x23e0
[ 44.296255][ T9495] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 44.296262][ T9495] allocate_slab+0x7d/0x610
[ 44.296267][ T9495] refill_objects+0x2d6/0x350
[ 44.296272][ T9495] __pcs_replace_empty_main+0x2c9/0x6c0
[ 44.296281][ T9495] __kmalloc_noprof+0x48b/0x720
[ 44.296288][ T9495] usb_hcd_submit_urb+0x7a3/0x1b40
[ 44.296301][ T9495] usb_start_wait_urb+0x13f/0x5b0
[ 44.296308][ T9495] usb_control_msg+0x234/0x3e0
[ 44.296314][ T9495] hub_power_on+0x1b6/0x460
[ 44.296320][ T9495] hub_activate+0x345/0x1a80
[ 44.296327][ T9495] hub_probe+0x291e/0x3c10
[ 44.296334][ T9495] usb_probe_interface+0x71f/0xe00
[ 44.296342][ T9495] really_probe+0x267/0xaf0
[ 44.296366][ T9495] __driver_probe_device+0x1e2/0x350
[ 44.296372][ T9495] page_owner free stack trace missing
[ 44.296375][ T9495]
[ 44.296377][ T9495] Memory state around the buggy address:
[ 44.296381][ T9495] ffff88810d471900: 00 04 fc fc 00 07 fc fc 00
00 fc fc 00 01 fc fc
[ 44.296385][ T9495] ffff88810d471980: 00 01 fc fc 00 01 fc fc fa
fb fc fc 00 01 fc fc
[ 44.296389][ T9495] >ffff88810d471a00: 00 03 fc fc fa fb fc fc fa
fb fc fc 00 01 fc fc
[ 44.296393][ T9495] ^
[ 44.296396][ T9495] ffff88810d471a80: fa fb fc fc fa fb fc fc 00
00 fc fc 00 01 fc fc
[ 44.296400][ T9495] ffff88810d471b00: 00 01 fc fc 00 01 fc fc 00
05 fc fc 00 05 fc fc
[ 44.296404][ T9495]
==================================================================
[ 44.297569][ T9495] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 44.352486][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.353650][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.354609][ T9495] Call Trace:
[ 44.354919][ T9495] <TASK>
[ 44.355192][ T9495] vpanic+0x56d/0xa60
[ 44.355639][ T9495] ? __pfx_vpanic+0x10/0x10
[ 44.356061][ T9495] panic+0xc5/0xd0
[ 44.356407][ T9495] ? __pfx_panic+0x10/0x10
[ 44.356831][ T9495] ? preempt_schedule_thunk+0x16/0x40
[ 44.357323][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.357800][ T9495] ? preempt_schedule_thunk+0x16/0x40
[ 44.358291][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.358771][ T9495] check_panic_on_warn+0x89/0xb0
[ 44.359225][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.359702][ T9495] end_report+0x73/0x170
[ 44.360095][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.360566][ T9495] kasan_report+0x128/0x150
[ 44.360998][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.361471][ T9495] kasan_check_range+0x264/0x2c0
[ 44.361929][ T9495] ? gb_hid_raw_request+0x29c/0x860
[ 44.362430][ T9495] __asan_memcpy+0x40/0x70
[ 44.362863][ T9495] gb_hid_raw_request+0x29c/0x860
[ 44.363348][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10
[ 44.363865][ T9495] ? __hid_hw_raw_request+0xa7/0x140
[ 44.364348][ T9495] hidraw_send_report+0x2bf/0x540
[ 44.364825][ T9495] ? bpf_lsm_file_permission+0x9/0x20
[ 44.365314][ T9495] hidraw_write+0x91/0xd0
[ 44.365786][ T9495] ? __pfx_hidraw_write+0x10/0x10
[ 44.366245][ T9495] vfs_write+0x29a/0xb90
[ 44.366636][ T9495] ? __pfx_vfs_write+0x10/0x10
[ 44.367076][ T9495] ? __fget_files+0x2a/0x420
[ 44.367500][ T9495] ? __fget_files+0x2a/0x420
[ 44.367924][ T9495] ? __fget_files+0x3a0/0x420
[ 44.368352][ T9495] ? __fget_files+0x2a/0x420
[ 44.368791][ T9495] ksys_write+0x150/0x270
[ 44.369188][ T9495] ? __pfx_ksys_write+0x10/0x10
[ 44.369633][ T9495] do_syscall_64+0x155/0x510
[ 44.370063][ T9495] ? trace_irq_disable+0x3b/0x140
[ 44.370523][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.371077][ T9495] ? clear_bhb_loop+0x30/0x80
[ 44.371509][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.372046][ T9495] RIP: 0033:0x4521d2
[ 44.372407][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 44.374131][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
[ 44.374887][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 00000000004521d2
[ 44.375673][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6
RDI: 0000000000000004
[ 44.376381][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000
R09: 0000000000000000
[ 44.377101][ T9495] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffcc5937c28
[ 44.377812][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002
R15: 00000000004cba40
[ 44.378522][ T9495] </TASK>
[ 44.379100][ T9495] Kernel Offset: disabled
[ 44.379644][ T9495] Rebooting in 86400 seconds..
Regards,
SEFCOM Lab @ ASU
Attachment:
211.patch
Description: Binary data
Attachment:
reproducer.c
Description: Binary data