UBSAN: shift-out-of-bounds in ocfs2_fill_super

Status: upstream: reported C repro on 2025/07/29 03:00
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+1ec46daa2003c61709fa@syzkaller.appspotmail.com
First crash: 364d, last: 8d19h
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/07/31 linux-6.6.y (ToT) dbcb8d8e4163 C [report] UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/31 upstream (ToT) 260f6f4fda93 C Didn't crash
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in ocfs2_fill_super ocfs2 -1 C 199 644d 711d 28/29 fixed on 2024/10/22 11:56
linux-5.15 UBSAN: shift-out-of-bounds in ocfs2_fill_super missing-backport origin:lts-only -1 C done 97 9d03h 665d 0/3 upstream: reported C repro on 2024/09/30 21:30
upstream UBSAN: shift-out-of-bounds in ocfs2_fill_super (2) ocfs2 -1 C 81 618d 639d 28/29 fixed on 2024/12/16 09:50
linux-6.1 UBSAN: shift-out-of-bounds in ocfs2_fill_super origin:lts-only -1 C error 118 8d14h 639d 0/3 upstream: reported C repro on 2024/10/27 03:28
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2025/08/12 20:17 2h35m fix candidate upstream OK (0) job log

Sample crash report:
WARNING: The mand mount option has been deprecated and
         and is ignored by this kernel. Remove the mand
         option from the mount to silence this warning.
=======================================================
================================================================================
UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2367:4
shift exponent 32 is too large for 32-bit type 'int'
CPU: 0 PID: 5930 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_shift_out_of_bounds+0x368/0x3f0 lib/ubsan.c:387
 ocfs2_verify_volume fs/ocfs2/super.c:2368 [inline]
 ocfs2_sb_probe fs/ocfs2/super.c:792 [inline]
 ocfs2_fill_super+0xf20/0x5030 fs/ocfs2/super.c:988
 mount_bdev+0x21c/0x2c0 fs/super.c:1643
 legacy_get_tree+0xea/0x180 fs/fs_context.c:662
 vfs_get_tree+0x8c/0x280 fs/super.c:1764
 do_new_mount+0x24a/0xa40 fs/namespace.c:3386
 do_mount fs/namespace.c:3726 [inline]
 __do_sys_mount fs/namespace.c:3935 [inline]
 __se_sys_mount+0x2e7/0x3d0 fs/namespace.c:3912
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd79a99e0ca
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd1f66058 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffcd1f660e0 RCX: 00007fd79a99e0ca
RDX: 0000200000004440 RSI: 0000200000000040 RDI: 00007ffcd1f660a0
RBP: 0000200000004440 R08: 00007ffcd1f660e0 R09: 00000000000008c0
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000200000000040
R13: 00007ffcd1f660a0 R14: 0000000000004443 R15: 0000200000000140
 </TASK>
================================================================================

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/30 00:57 linux-6.6.y d1cfde2d5d15 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/14 03:21 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/29 17:03 linux-6.6.y dbcb8d8e4163 c4a95487 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/19 08:22 linux-6.6.y da47cbc25466 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/19 08:22 linux-6.6.y da47cbc25466 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/06/29 21:48 linux-6.6.y d1cfde2d5d15 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/06/29 21:48 linux-6.6.y d1cfde2d5d15 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/04 08:43 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/04 08:43 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/28 10:56 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/22 14:10 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/22 14:09 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/21 08:19 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/19 03:49 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/14 02:59 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/10/29 09:40 linux-6.6.y 4a243110dc88 fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/10/29 09:40 linux-6.6.y 4a243110dc88 fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/09/07 03:25 linux-6.6.y 355bd0b51d2f d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/09/07 03:22 linux-6.6.y 355bd0b51d2f d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/29 03:00 linux-6.6.y dbcb8d8e4163 6654ea9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/29 03:00 linux-6.6.y dbcb8d8e4163 6654ea9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
* Struck through repros no longer work on HEAD.