syzbot

 sign-in | mailing list | source | docs
🐞 Open [873] ≡ Subsystems 🐞 Fixed [4875] 🐞 Invalid [11637] ⬇ Missing Backports [68] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: array-index-out-of-bounds in dbAdjTree

Status: upstream: reported C repro on 2022/09/26 09:44
Subsystems: jfs
[Documentation on labels]
Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com
Fix commit: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree jfs: fix array-index-out-of-bounds in dbAdjTree
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 432d, last: 2d01h
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH] jfs: fix array-index-out-of-bounds in dbAdjTree 3 (3) 2023/11/01 15:44
[PATCH] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree 2 (2) 2023/11/01 14:39
[syzbot] UBSAN: array-index-out-of-bounds in dbAdjTree 0 (1) 2022/09/26 09:44
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: slab-out-of-bounds Read in dbAdjTree C 3 278d 425d 0/1 upstream: reported C repro on 2022/10/03 00:17
linux-4.19 KASAN: use-after-free Read in dbAdjTree C error 5 279d 396d 0/1 upstream: reported C repro on 2022/10/31 14:16
▶ ▼ Last patch testing requests (13)
Created Duration User Patch Repo Result
2023/10/25 22:32 31m (2) retest repro upstream report log
2023/10/25 22:32 11m retest repro upstream report log
2023/10/25 22:32 10m retest repro upstream report log
2023/10/25 22:14 15m retest repro linux-next report log
2023/10/25 22:14 19m retest repro upstream report log
2023/10/25 22:14 21m retest repro upstream report log
2023/10/25 22:14 20m retest repro linux-next report log
2023/10/17 11:50 19m ghandatmanas@gmail.com patch https://github.com/kleikamp/linux-shaggy.git jfs-next OK log
2023/10/17 07:51 12m ghandatmanas@gmail.com https://github.com/kleikamp/linux-shaggy.git jfs-next report log
2023/10/11 16:21 20m osmtendev@gmail.com patch https://github.com/torvalds/linux.git master OK log
2023/07/27 05:17 2h29m retest repro upstream report log
2023/07/27 05:17 1h26m retest repro upstream OK log
2023/07/27 05:24 13m retest repro linux-next report log
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2023/04/26 11:43 8h05m bisect fix upstream error job log (0)
2023/03/27 10:54 46m bisect fix upstream job log (0) log
2023/02/14 13:14 23m bisect fix upstream job log (0) log

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6
index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]')
CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867
 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834
 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331
 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]
 dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402
 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534
 txUpdateMap+0x342/0x9e0
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x2d3/0x370 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>
================================================================================
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 panic+0x30f/0x770 kernel/panic.c:340
 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236
 ubsan_epilogue lib/ubsan.c:223 [inline]
 __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348
 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867
 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834
 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331
 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]
 dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402
 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534
 txUpdateMap+0x342/0x9e0
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x2d3/0x370 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/09/25 11:12 upstream 6465e260f487 0b6a67ac .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/10 03:46 upstream a6afa4199d3d aea5da89 .config strace log report syz C [disk image] [vmlinux] [mounted in repro] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/04 21:04 upstream 4fe89d07dcc2 eab8f949 .config strace log report syz C [disk image] [vmlinux] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/09/25 07:34 upstream 1a61b828566f 0042f2b4 .config strace log report syz C [disk image] [vmlinux] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/09/25 07:28 upstream 3db61221f4e8 0042f2b4 .config strace log report syz C ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/11/06 05:28 linux-next 0cdb3579f1ee 6d752409 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/24 05:33 linux-next 4d48f589d294 23bf86af .config strace log report syz C [disk image] [vmlinux] [mounted in repro] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2023/02/25 10:53 upstream 8cbd92339db0 ee50e71c .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/30 00:37 upstream 3b47bc037bd4 6e78f9ce .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/22 14:33 upstream c2d5304e6c64 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/21 22:54 upstream c2d5304e6c64 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/18 16:04 upstream 791c8ab095f7 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/12 17:50 upstream 1b907d050735 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/11 21:36 upstream 3ca112b71f35 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/11/11 18:03 upstream 3ca112b71f35 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/10/11 21:52 upstream 1c8b86a3799f 83165b57 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2023/09/29 23:15 upstream 71e58659bfc0 8e26a358 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/09/29 22:48 upstream 71e58659bfc0 8e26a358 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/09/25 10:10 upstream 6465e260f487 0b6a67ac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/05/18 05:15 upstream 1b66c114d161 3bb7af1d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/02/25 09:36 upstream 8cbd92339db0 ee50e71c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2023/01/15 13:14 upstream 7c6984405241 a63719e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/11/11 17:22 upstream 4bbf3422df78 f42ee5d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/11/02 10:21 upstream b229b6ca5abb 08977f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/11/01 12:34 upstream b229b6ca5abb a1d8560a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/25 02:02 upstream 247f34f7b803 ff2fe65d .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/19 19:55 upstream 493ffd6605b2 b31320fc .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/18 22:39 upstream 493ffd6605b2 b31320fc .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/18 08:30 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/17 22:39 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/17 20:43 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/17 19:04 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/17 01:12 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/16 13:11 upstream 493ffd6605b2 67cb024c .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/12 00:17 upstream 55be6084c8e0 1353c374 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in dbAdjTree
2022/10/10 20:19 upstream 493ffd6605b2 5bcf0c31 .config console log report info [disk image] [vmlinux] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAdjTree
* Struck through repros no longer work on HEAD.