syzbot

 sign-in | mailing list | source | docs
🐞 Open [1599]
≡ Subsystems
🐞 Fixed [6317]
🐞 Invalid [16059]
⬇ Missing Backports [190]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update

Status: upstream: reported C repro on 2025/04/28 17:04
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+14c52d86ddbd89bea13e@syzkaller.appspotmail.com
Fix commit: 082c74411491 bcachefs: Fix downgrade_table_extra()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-bpf-next-kasan-gce]
First crash: 56d, last: 19h04m
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update 0 (2) 2025/06/08 16:01

Sample crash report:
bcachefs (loop0): bucket 0:26 gen 0 data type btree sector count overflow: 0 + -256 > U32_MAX
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/bcachefs/sb-downgrade.c:268:4
index 0 is out of range for type '__le16[] __counted_by(nr_errors)' (aka 'unsigned short[]')
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
 panic+0x2db/0x790 kernel/panic.c:354
 check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (539):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/24 19:38 upstream e72e9e693307 9c80ffa0 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 06:04 upstream 939f15e640f1 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 23:51 upstream 27605c8c0f69 1f72c409 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 21:33 upstream 27605c8c0f69 1f72c409 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 15:44 upstream 27605c8c0f69 1f72c409 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 11:05 upstream 27605c8c0f69 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 03:58 upstream 27605c8c0f69 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/13 02:57 upstream 27605c8c0f69 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 13:24 upstream 2c4a1f3fe03e 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 12:06 upstream 2c4a1f3fe03e 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 05:44 upstream 488ef3560196 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 04:39 upstream 488ef3560196 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 03:35 upstream 488ef3560196 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/12 01:13 upstream 488ef3560196 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 22:49 upstream 488ef3560196 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 19:09 upstream aef17cb3d3c4 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 17:17 upstream aef17cb3d3c4 98683f8f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 09:58 upstream aef17cb3d3c4 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 08:40 upstream aef17cb3d3c4 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 07:09 upstream aef17cb3d3c4 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/11 03:45 upstream aef17cb3d3c4 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/10 16:36 upstream f09079bd04a9 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/10 14:29 upstream f09079bd04a9 5d7e17ca .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/10 02:38 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 21:43 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 18:57 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 16:10 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 13:34 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 12:29 upstream 19272b37aa4f 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/09 02:31 upstream 939f15e640f1 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 22:31 upstream 939f15e640f1 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 12:38 upstream 8630c59e9936 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 06:58 upstream 8630c59e9936 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 05:50 upstream 8630c59e9936 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 04:27 upstream 8630c59e9936 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/08 03:10 upstream 8630c59e9936 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 20:31 upstream bdc7f8c5adad 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 18:20 upstream bdc7f8c5adad 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 16:27 upstream bdc7f8c5adad 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 14:18 upstream bdc7f8c5adad 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 04:26 upstream c0c9379f235d 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/07 03:21 upstream c0c9379f235d 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/06 23:57 upstream c0c9379f235d 4826c28e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/06 16:30 upstream e271ed52b344 3d899f2c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/19 19:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 39dfc971e42d ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/17 22:13 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 39dfc971e42d 417d98fa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/17 16:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 39dfc971e42d 417d98fa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/06/14 19:23 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 39dfc971e42d 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
* Struck through repros no longer work on HEAD.