syzbot


UBSAN: array-index-out-of-bounds in diFree

Status: fixed on 2024/08/14 03:44
Subsystems: jfs
[Documentation on labels]
Reported-by: syzbot+241c815bda521982cb49@syzkaller.appspotmail.com
Fix commit: f73f969b2eb3 jfs: Fix array-index-out-of-bounds in diFree
First crash: 303d, last: 189d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: INFO: trying to register non-static key in diFree (log)
Repro: C syz .config
  
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] jfs: Fix array-index-out-of-bounds in diFree 17 (17) 2024/06/26 17:40
[syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diFree 5 (11) 2024/04/25 09:39
Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: array-index-out-of-bounds in diFree origin:upstream missing-backport C done 13 186d 232d 3/3 fixed on 2024/09/19 18:24
upstream KASAN: use-after-free Read in diFree jfs C inconclusive unreliable 110 415d 1063d 0/28 auto-obsoleted due to no activity on 2024/03/22 04:27
linux-4.19 BUG: unable to handle kernel paging request in diFree C done 18 1310d 1602d 1/1 fixed on 2021/08/17 00:59
linux-4.14 general protection fault in diFree 1 1480d 1480d 0/1 auto-closed as invalid on 2021/05/28 19:31
linux-4.14 general protection fault in diFree (2) C 2 720d 1125d 0/1 upstream: reported C repro on 2022/01/18 19:31
linux-5.15 KASAN: use-after-free Read in diFree C error 5 609d 681d 0/3 auto-obsoleted due to no activity on 2023/10/07 20:25
upstream BUG: unable to handle kernel paging request in diFree jfs C done 13 1332d 1603d 20/28 fixed on 2021/11/10 00:50
linux-4.19 KASAN: use-after-free Read in diFree jfs C error 21 750d 1588d 0/1 upstream: reported C repro on 2020/10/13 01:51
linux-4.14 BUG: unable to handle kernel paging request in diFree C 5 728d 1608d 0/1 upstream: reported C repro on 2020/09/23 16:53
linux-6.1 KASAN: use-after-free Read in diFree origin:lts-only C done 7 508d 669d 3/3 fixed on 2023/10/30 11:46
linux-4.14 KASAN: use-after-free Read in diFree jfs C error 3 728d 1601d 0/1 upstream: reported C repro on 2020/09/30 00:31
Last patch testing requests (5)
Created Duration User Patch Repo Result
2024/04/25 09:04 15m aha310510@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master report log
2024/04/25 08:56 11m aha310510@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master report log
2024/04/25 04:59 45m aha310510@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master report log
2024/04/25 03:16 39m aha310510@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master report log
2024/04/24 04:12 20m aha310510@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master OK log

Sample crash report:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:886:2
index -134217728 is out of range for type 'struct mutex[128]'
CPU: 1 PID: 114 Comm: jfsCommit Not tainted 6.10.0-rc6-syzkaller-00048-g73e931504f8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429
 diFree+0x21c3/0x2fb0 fs/jfs/jfs_imap.c:886
 jfs_evict_inode+0x32d/0x440 fs/jfs/inode.c:156
 evict+0x2a8/0x630 fs/inode.c:667
 txUpdateMap+0x829/0x9f0 fs/jfs/jfs_txnmgr.c:2367
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x49a/0xb80 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 1 PID: 114 Comm: jfsCommit Not tainted 6.10.0-rc6-syzkaller-00048-g73e931504f8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 panic+0x349/0x860 kernel/panic.c:347
 check_panic_on_warn+0x86/0xb0 kernel/panic.c:240
 ubsan_epilogue lib/ubsan.c:236 [inline]
 __ubsan_handle_out_of_bounds+0x141/0x150 lib/ubsan.c:429
 diFree+0x21c3/0x2fb0 fs/jfs/jfs_imap.c:886
 jfs_evict_inode+0x32d/0x440 fs/jfs/inode.c:156
 evict+0x2a8/0x630 fs/inode.c:667
 txUpdateMap+0x829/0x9f0 fs/jfs/jfs_txnmgr.c:2367
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x49a/0xb80 fs/jfs/jfs_txnmgr.c:2733
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (226):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/02 04:31 upstream 73e931504f8e b294e901 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/22 15:29 upstream 35bb670d65fc edc5149a .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/04/19 23:22 upstream 3cdb45594619 af24b050 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/23 23:05 upstream 28bbe4ea686a e50e8da5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/22 16:51 upstream 933069701c1b df655b64 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/22 13:53 upstream 933069701c1b df655b64 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/14 21:28 upstream 4d145e3f830b eaeb5c15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/14 06:43 upstream 4d145e3f830b eaeb5c15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/13 09:18 upstream 975f3b6da180 eaeb5c15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/10 04:06 upstream 34afb82a3c67 bc144f9a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/09 19:33 upstream 34afb82a3c67 79d68ada .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/07 21:45 upstream c6653f49e4fd 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/07 08:35 upstream 22f902dfc51e 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/07 07:30 upstream 22f902dfc51e bc4ebbb5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in diFree
2024/07/07 03:19 upstream 22f902dfc51e 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/06 17:16 upstream 1dd28064d416 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/05 03:33 upstream 795c58e4c7fc dc6bbff0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in diFree
2024/07/04 13:51 upstream 795c58e4c7fc 3f2748a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/03 16:59 upstream e9d22f7a6655 1ecfa2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/02 04:01 upstream 73e931504f8e b294e901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/07/02 01:06 upstream 22a40d14b572 b294e901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/23 18:29 upstream 5f583a3162ff edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/23 04:20 upstream 563a50672d8a edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/20 08:48 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/20 05:18 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/20 03:57 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/19 08:13 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/18 19:15 upstream 2ccbdf43d5e7 639d6cdf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/16 18:02 upstream 2ccbdf43d5e7 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root UBSAN: array-index-out-of-bounds in diFree
2024/06/16 02:52 upstream 2ccbdf43d5e7 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in diFree
2024/06/14 07:59 upstream 2ccbdf43d5e7 a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/14 00:08 upstream 2ccbdf43d5e7 a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/13 21:36 upstream 2ccbdf43d5e7 a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/13 11:02 upstream 2ccbdf43d5e7 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/13 08:31 upstream 2ccbdf43d5e7 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/11 16:24 upstream 83a7eefedc9b b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/11 12:23 upstream 83a7eefedc9b b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/06/11 04:44 upstream 83a7eefedc9b 048c640a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in diFree
2024/04/26 05:57 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in diFree
2024/06/20 19:40 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/19 15:10 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/18 10:55 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/18 00:20 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/16 08:00 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/15 00:27 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in diFree
2024/06/20 18:38 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in diFree
2024/06/20 16:34 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in diFree
2024/06/14 10:22 linux-next a957267fa7e9 a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in diFree
2024/06/13 14:05 linux-next a957267fa7e9 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in diFree
2024/08/12 09:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c912bf709078 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/07/18 00:54 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c912bf709078 03114f55 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/07/16 03:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c912bf709078 efee4ed2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/06/30 18:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8fcad59bb267 757f06b1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/06/24 17:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ac2193b4b460 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/06/20 07:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ac2193b4b460 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/06/17 01:51 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ac2193b4b460 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
2024/06/16 14:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ac2193b4b460 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in diFree
* Struck through repros no longer work on HEAD.