syzbot

 sign-in | mailing list | source | docs
🐞 Open [1516]
≡ Subsystems
🐞 Fixed [5896]
🐞 Invalid [14318]
⬇ Missing Backports [96]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

UBSAN: shift-out-of-bounds in ext4_fill_super

Status: fixed on 2021/03/10 01:48
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+345b75652b1d24227443@syzkaller.appspotmail.com
Fix commit: c9200760da8a ext4: check for invalid block size early when mounting a file system
First crash: 1459d, last: 1442d
Cause bisection: introduced by (bisect log) [release commit]:
commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun Sep 15 21:19:32 2019 +0000

  Linux 5.3

Crash: UBSAN: undefined-behaviour in ext4_fill_super (log)
Repro: C syz .config
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 5.10 00/63] 5.10.5-rc1 review 75 (75) 2021/01/07 08:13
[PATCH AUTOSEL 5.10 01/31] ARM: 9014/2: Replace string mem* functions for KASan 37 (37) 2021/01/04 14:29
UBSAN: shift-out-of-bounds in ext4_fill_super 7 (10) 2020/12/15 10:09
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 UBSAN: shift-out-of-bounds in ext4_fill_super origin:upstream C error 1 91d 346d 0/2 upstream: reported C repro on 2023/12/25 17:58
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2020/12/10 13:57 16m dvyukov@google.com patch git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git e360ba58d067a30a4e3e7d55ebdd919885a058d6 OK
2020/12/10 02:36 0m tytso@mit.edu patch git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git e360ba58d067a30a4e3e7d55ebdd919885a058d6 error
2020/12/10 02:21 16m anant.thazhemadam@gmail.com patch upstream error

Sample crash report:
loop0: detected capacity change from 4 to 0
================================================================================
UBSAN: shift-out-of-bounds in fs/ext4/super.c:4190:25
shift exponent 589825 is too large for 32-bit type 'int'
CPU: 1 PID: 8498 Comm: syz-executor023 Not tainted 5.10.0-rc6-next-20201207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 ext4_fill_super.cold+0x154/0x3ce fs/ext4/super.c:4190
 mount_bdev+0x34d/0x410 fs/super.c:1366
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1496
 do_new_mount fs/namespace.c:2896 [inline]
 path_mount+0x12ae/0x1e70 fs/namespace.c:3227
 do_mount fs/namespace.c:3240 [inline]
 __do_sys_mount fs/namespace.c:3448 [inline]
 __se_sys_mount fs/namespace.c:3425 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446d6a
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc2d215018 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc2d215070 RCX: 0000000000446d6a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc2d215030
RBP: 00007ffc2d215030 R08: 00007ffc2d215070 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001
R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
================================================================================

Crashes (88):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/08 04:51 linux-next 15ac8fdb7440 51a9082e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/12/24 19:32 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 16:27 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 05:55 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/23 14:45 upstream 614cb5894306 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/23 14:15 upstream 614cb5894306 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/23 02:12 upstream 614cb5894306 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/22 17:04 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/22 11:35 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/22 09:03 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/22 08:02 upstream 8653b778e454 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 19:04 upstream e37b12e4bb21 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 09:22 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 05:21 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/20 12:19 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/20 06:21 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/19 19:41 upstream 3644e2d2dda7 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/19 03:30 upstream a409ed156a90 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 23:46 upstream a409ed156a90 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 22:51 upstream a409ed156a90 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 15:08 upstream d64c6f96ba86 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/18 05:43 upstream d64c6f96ba86 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/17 18:07 upstream accefff5b547 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/17 04:09 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/17 02:05 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/17 00:48 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/16 21:52 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/16 20:26 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/15 02:55 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 22:15 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 21:01 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 20:20 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 20:19 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 20:15 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 19:41 linux-next 14240d4c5b25 97183ed7 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 08:54 linux-next 14240d4c5b25 b22a7ec3 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 03:39 linux-next 14240d4c5b25 b22a7ec3 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/12 23:36 linux-next 14240d4c5b25 bca53db9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/12 05:03 linux-next 14240d4c5b25 ba24ffcd .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 21:16 linux-next 14240d4c5b25 ba24ffcd .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 20:08 linux-next 14240d4c5b25 ba24ffcd .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 19:54 linux-next 14240d4c5b25 ba24ffcd .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 18:56 linux-next 14240d4c5b25 ba24ffcd .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 04:49 linux-next 14240d4c5b25 f900b48c .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 03:52 linux-next 14240d4c5b25 f900b48c .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 01:45 linux-next 14240d4c5b25 f900b48c .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 20:12 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 16:18 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 16:01 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 14:25 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.