UBSAN: shift-out-of-bounds in sg_build_indirect

Status: upstream: reported C repro on 2025/02/14 19:58
Subsystems: scsi
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+270f1c719ee7baab9941@syzkaller.appspotmail.com
First crash: 634d, last: 53d
▶ ▼ ✨ AI Patch Versions (5)
Version Stage Reported Report Link Job
1 upstream 2026/09/17 08:04 Discussion 1d412b83-5bbc-4d73-b690-4c798d45cee4
3 moderation 2026/09/16 16:08 Discussion 1d412b83-5bbc-4d73-b690-4c798d45cee4
2 moderation 2026/09/14 08:28 Discussion e273ef4c-bec0-4d7e-af59-32e327619af1
1 moderation 2026/09/09 19:39 Discussion 4512b081-e607-45b8-8a53-4eefe3737482
1 moderation 2026/05/20 23:41 Discussion 9fc73d11-e044-468a-84ed-9ae3a79a07b0
▶ ▼ ✨ AI Jobs (7)
ID Workflow Result Correct Bug Created Started Finished Revision
0721fa09 patch-iteration ❓ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/09/16 16:08 2026/09/16 16:08 2026/09/16 16:56 95928915
1d412b83 patch-iteration ✅ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/09/16 15:09 2026/09/16 15:09 2026/09/16 16:08 95928915
e273ef4c patch-iteration ❓ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/09/14 07:49 2026/09/14 07:50 2026/09/14 08:28 70a60e12
4512b081 patching ❓ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/09/09 16:10 2026/09/09 16:22 2026/09/09 19:39 b31349d1
df0f8f2e assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/05/31 06:03 2026/05/31 06:03 2026/05/31 06:45 6b4a8443
9fc73d11 patching ❓ UBSAN: shift-out-of-bounds in sg_build_indirect 2026/05/20 18:07 2026/05/20 21:47 2026/05/20 23:41 cf874a1c
c1c6579f assessment-security 💥 UBSAN: shift-out-of-bounds in sg_build_indirect 2026/05/14 14:20 2026/05/14 14:20 2026/05/14 14:21 6ccb967e
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH] scsi: sg: Fix shift-out-of-bounds in sg_build_indirect() 2 (2) 2026/11/02 10:42
[syzbot] [scsi?] UBSAN: shift-out-of-bounds in sg_build_indirect 0 (6) 2025/11/07 18:02
[PATCH] scsi: fix shift out-of-bounds in sg_build_indirect The num variable is set to 0. The variable num gets its value from scatter_elem_sz. However the minimum value of scatter_elem_sz is PAGE_SHIFT. So setting num to PAGE_SIZE when num < PAGE_SIZE. 5 (5) 2025/10/07 01:42
[PATCH] scsi: sg: prevent the use of size 0 to obtain the page order of sg 1 (1) 2025/02/16 03:35
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2026/09/18 09:54 23m retest repro upstream report job log log
2026/09/04 06:19 22m retest repro upstream report job log log
2026/07/10 09:24 27m retest repro upstream report log
2026/06/26 05:48 23m retest repro upstream report log
2026/05/01 08:58 23m retest repro upstream report log
2026/04/17 05:27 18m retest repro upstream report log
2026/02/15 04:36 14m retest repro upstream report log
2025/12/07 04:18 15m retest repro upstream report log
2025/11/07 18:02 21m kshitijvparanjape@gmail.com patch upstream OK log
2025/11/07 17:29 6m kshitijvparanjape@gmail.com patch upstream error
2025/10/10 11:44 5m kshitijvparanjape@gmail.com patch upstream error
2025/10/06 13:34 21m kshitijvparanjape@gmail.com patch upstream OK log
2025/09/28 03:58 15m xandfury@gmail.com upstream report log
2025/09/26 16:18 15m retest repro upstream report log
2025/07/18 15:54 14m retest repro upstream report log

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1898:13
shift exponent 64 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1898
 sg_build_reserve+0xc8/0x180 drivers/scsi/sg.c:2008
 sg_add_sfp drivers/scsi/sg.c:2190 [inline]
 sg_open+0xd5c/0x1aa0 drivers/scsi/sg.c:349
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4677 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4836
 do_file_open+0x20e/0x430 fs/namei.c:4865
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabff99c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfaefbef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fabffc15fa0 RCX: 00007fabff99c819
RDX: 00000000000c0482 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007fabffa32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabffc15fac R14: 00007fabffc15fa0 R15: 00007fabffc15fa0
 </TASK>
---[ end trace ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/03 05:03 upstream 5619b098e2fb 4440e7c2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2025/02/14 15:00 upstream 128c8f96eb86 fe17639f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2026/04/03 03:06 upstream 5619b098e2fb 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
2025/02/14 09:02 upstream ab68d7eb7b1a d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto UBSAN: shift-out-of-bounds in sg_build_indirect
* Struck through repros no longer work on HEAD.