| Version | Stage | Reported | Report Link | Job |
|---|---|---|---|---|
| 1 | moderation | 2026/05/20 23:41 | Discussion | 9fc73d11-e044-468a-84ed-9ae3a79a07b0 |
syzbot |
sign-in | mailing list | source | docs | 🏰 |
| Version | Stage | Reported | Report Link | Job |
|---|---|---|---|---|
| 1 | moderation | 2026/05/20 23:41 | Discussion | 9fc73d11-e044-468a-84ed-9ae3a79a07b0 |
| ID | Workflow | Result | Correct | Bug | Created | Started | Finished | Revision | Error |
|---|---|---|---|---|---|---|---|---|---|
| df0f8f2e-c82f-4058-bf77-bc08fd3465c8 | assessment-security | DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ | ❓ | UBSAN: shift-out-of-bounds in sg_build_indirect | 2026/05/31 06:03 | 2026/05/31 06:03 | 2026/05/31 06:45 | 6b4a844333e83556da95d61d7f207e7ef5cd4bc6 | |
| 9fc73d11-e044-468a-84ed-9ae3a79a07b0 | patching | ❓ | UBSAN: shift-out-of-bounds in sg_build_indirect | 2026/05/20 18:07 | 2026/05/20 21:47 | 2026/05/20 23:41 | cf874a1cf36318c06202027159ddac14acf00db7 | ||
| c1c6579f-71a7-4aea-84e4-0fb54eea50a2 | assessment-security | 💥 | UBSAN: shift-out-of-bounds in sg_build_indirect | 2026/05/14 14:20 | 2026/05/14 14:20 | 2026/05/14 14:21 | 6ccb967e465e832a7bfd7a116ad00d52a0923a5d |
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/7d04bb36e88e4cb12e... truncated to first 200 bytes; open job for full error
|
| Title | Replies (including bot) | Last reply |
|---|---|---|
| [syzbot] [scsi?] UBSAN: shift-out-of-bounds in sg_build_indirect | 0 (6) | 2025/11/07 18:02 |
| [PATCH] scsi: fix shift out-of-bounds in sg_build_indirect The num variable is set to 0. The variable num gets its value from scatter_elem_sz. However the minimum value of scatter_elem_sz is PAGE_SHIFT. So setting num to PAGE_SIZE when num < PAGE_SIZE. | 5 (5) | 2025/10/07 01:42 |
| [PATCH] scsi: sg: prevent the use of size 0 to obtain the page order of sg | 1 (1) | 2025/02/16 03:35 |
| Created | Duration | User | Patch | Repo | Result |
|---|---|---|---|---|---|
| 2026/05/01 08:58 | 23m | retest repro | upstream | report log | |
| 2026/04/17 05:27 | 18m | retest repro | upstream | report log | |
| 2026/02/15 04:36 | 14m | retest repro | upstream | report log | |
| 2025/12/07 04:18 | 15m | retest repro | upstream | report log | |
| 2025/11/07 18:02 | 21m | kshitijvparanjape@gmail.com | patch | upstream | OK log |
| 2025/11/07 17:29 | 6m | kshitijvparanjape@gmail.com | patch | upstream | error |
| 2025/10/10 11:44 | 5m | kshitijvparanjape@gmail.com | patch | upstream | error |
| 2025/10/06 13:34 | 21m | kshitijvparanjape@gmail.com | patch | upstream | OK log |
| 2025/09/28 03:58 | 15m | xandfury@gmail.com | upstream | report log | |
| 2025/09/26 16:18 | 15m | retest repro | upstream | report log | |
| 2025/07/18 15:54 | 14m | retest repro | upstream | report log | |
| 2025/05/09 15:30 | 15m | retest repro | upstream | report log | |
| 2025/02/28 15:12 | 16m | retest repro | upstream | report log |
------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1898:13 shift exponent 64 is too large for 32-bit type 'int' CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1898 sg_build_reserve+0xc8/0x180 drivers/scsi/sg.c:2008 sg_add_sfp drivers/scsi/sg.c:2190 [inline] sg_open+0xd5c/0x1aa0 drivers/scsi/sg.c:349 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4677 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4836 do_file_open+0x20e/0x430 fs/namei.c:4865 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fabff99c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcfaefbef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fabffc15fa0 RCX: 00007fabff99c819 RDX: 00000000000c0482 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007fabffa32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fabffc15fac R14: 00007fabffc15fa0 R15: 00007fabffc15fa0 </TASK> ---[ end trace ]---
| Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026/04/03 05:03 | upstream | 5619b098e2fb | 4440e7c2 | .config | console log | report | syz / log | C | [disk image] [vmlinux] [kernel image] | ci-qemu-gce-upstream-auto | UBSAN: shift-out-of-bounds in sg_build_indirect | |
| 2025/02/14 15:00 | upstream | 128c8f96eb86 | fe17639f | .config | console log | report | syz / log | C | [disk image] [vmlinux] [kernel image] | ci-qemu-gce-upstream-auto | UBSAN: shift-out-of-bounds in sg_build_indirect | |
| 2026/04/03 03:06 | upstream | 5619b098e2fb | 4440e7c2 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-qemu-gce-upstream-auto | UBSAN: shift-out-of-bounds in sg_build_indirect | ||
| 2025/02/14 09:02 | upstream | ab68d7eb7b1a | d9a046cf | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-qemu-gce-upstream-auto | UBSAN: shift-out-of-bounds in sg_build_indirect |