syzbot


UBSAN: array-index-out-of-bounds in dbNextAG

Status: upstream: reported C repro on 2024/07/07 08:50
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+22660dec1bb428d3081e@syzkaller.appspotmail.com
First crash: 102d, last: 9d06h
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: UBSAN: array-index-out-of-bounds in dbNextAG (log)
Repro: C syz .config
  
Bug presence (3)
Date Name Commit Repro Result
2024/10/08 linux-6.1.y (ToT) aa4cd140bba5 C [report] UBSAN: array-index-out-of-bounds in dbNextAG
2024/07/07 upstream (ToT) 5a4bd506ddad C [report] UBSAN: array-index-out-of-bounds in dbNextAG
2024/10/08 upstream (ToT) 75b607fab38d C Didn't crash
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: array-index-out-of-bounds in dbNextAG origin:upstream C 4 9d19h 102d 0/3 upstream: reported C repro on 2024/07/07 08:53
upstream UBSAN: array-index-out-of-bounds in dbNextAG (2) jfs C inconclusive 53 28d 98d 27/28 upstream: reported C repro on 2024/07/11 08:55
upstream UBSAN: array-index-out-of-bounds in dbNextAG jfs C inconclusive inconclusive 52 325d 752d 25/28 fixed on 2023/12/21 01:43
linux-4.19 KASAN: use-after-free Read in dbNextAG jfs C error 12 649d 754d 0/1 upstream: reported C repro on 2022/09/25 01:19
linux-4.14 KASAN: use-after-free Read in dbNextAG C 2 604d 754d 0/1 upstream: reported C repro on 2022/09/25 01:19
Fix bisection attempts (3)
Created Duration User Patch Repo Result
2024/10/15 03:37 0m fix candidate upstream error job log
2024/09/26 03:45 1h56m bisect fix linux-6.1.y OK (0) job log log
2024/08/19 15:43 1h21m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
loop0: detected capacity change from 0 to 32768
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:661:7
index 128 is out of range for type 's64[128]' (aka 'long long[128]')
CPU: 0 PID: 3540 Comm: syz-executor143 Not tainted 6.1.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_out_of_bounds+0x118/0x140 lib/ubsan.c:282
 dbNextAG+0x3ef/0x630 fs/jfs/jfs_dmap.c:661
 diAlloc+0x6c2/0x1750 fs/jfs/jfs_imap.c:1369
 ialloc+0x8b/0x970 fs/jfs/jfs_inode.c:56
 jfs_create+0x1ba/0xbb0 fs/jfs/namei.c:92
 lookup_open fs/namei.c:3484 [inline]
 open_last_lookups fs/namei.c:3552 [inline]
 path_openat+0x12f1/0x2e60 fs/namei.c:3782
 do_filp_open+0x230/0x480 fs/namei.c:3812
 do_sys_openat2+0x13b/0x500 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd63ae61639
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff737df1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fff737df3b8 RCX: 00007fd63ae61639
RDX: 000000000000275a RSI: 00000000200005c0 RDI: 00000000ffffff9c
RBP: 00007fd63aeda610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff737df3a8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
================================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/07 17:13 linux-6.1.y 7753af06eebf 2a40360c .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dbNextAG
2024/07/07 08:49 linux-6.1.y 7753af06eebf 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dbNextAG
2024/07/07 08:49 linux-6.1.y 7753af06eebf 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dbNextAG
* Struck through repros no longer work on HEAD.