syzbot


UBSAN: shift-out-of-bounds in sg_build_indirect

Status: upstream: reported C repro on 2025/02/14 19:58
Subsystems: scsi
[Documentation on labels]
Reported-by: syzbot+270f1c719ee7baab9941@syzkaller.appspotmail.com
First crash: 438d, last: 11d
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] [scsi?] UBSAN: shift-out-of-bounds in sg_build_indirect 0 (6) 2025/11/07 18:02
[PATCH] scsi: fix shift out-of-bounds in sg_build_indirect The num variable is set to 0. The variable num gets its value from scatter_elem_sz. However the minimum value of scatter_elem_sz is PAGE_SHIFT. So setting num to PAGE_SIZE when num < PAGE_SIZE. 5 (5) 2025/10/07 01:42
[PATCH] scsi: sg: prevent the use of size 0 to obtain the page order of sg 1 (1) 2025/02/16 03:35
Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/04/17 05:27 18m retest repro upstream report log
2026/02/15 04:36 14m retest repro upstream report log
2025/12/07 04:18 15m retest repro upstream report log
2025/11/07 18:02 21m kshitijvparanjape@gmail.com patch upstream OK log
2025/11/07 17:29 6m kshitijvparanjape@gmail.com patch upstream error
2025/10/10 11:44 5m kshitijvparanjape@gmail.com patch upstream error
2025/10/06 13:34 21m kshitijvparanjape@gmail.com patch upstream OK log
2025/09/28 03:58 15m xandfury@gmail.com upstream report log
2025/09/26 16:18 15m retest repro upstream report log
2025/07/18 15:54 14m retest repro upstream report log
2025/05/09 15:30 15m retest repro upstream report log
2025/02/28 15:12 16m retest repro upstream report log

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1898:13
shift exponent 64 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1898
 sg_build_reserve+0xc8/0x180 drivers/scsi/sg.c:2008
 sg_add_sfp drivers/scsi/sg.c:2190 [inline]
 sg_open+0xd5c/0x1aa0 drivers/scsi/sg.c:349
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4677 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4836
 do_file_open+0x20e/0x430 fs/namei.c:4865
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabff99c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfaefbef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fabffc15fa0 RCX: 00007fabff99c819
RDX: 00000000000c0482 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007fabffa32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabffc15fac R14: 00007fabffc15fa0 R15: 00007fabffc15fa0
 </TASK>
---[ end trace ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/03 05:03 upstream 5619b098e2fb 4440e7c2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2025/02/14 15:00 upstream 128c8f96eb86 fe17639f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2026/04/03 03:06 upstream 5619b098e2fb 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2025/02/14 09:02 upstream ab68d7eb7b1a d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
* Struck through repros no longer work on HEAD.