UBSAN: shift-out-of-bounds in gfs2_dir_read (2)

Status: fixed on 2025/09/04 16:57
Subsystems: gfs2
[Documentation on labels]
Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
Fix commit: 557c024ca725 gfs2: Validate i_depth for exhash directories
First crash: 376d, last: 372d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) 3 (10) 2025/07/16 16:03
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: shift-out-of-bounds in gfs2_dir_read origin:upstream -1 C error 9 70d 376d 0/3 upstream: reported C repro on 2025/07/15 02:48
upstream UBSAN: shift-out-of-bounds in gfs2_dir_read gfs2 -1 1 575d 571d 0/29 auto-obsoleted due to no activity on 2025/04/06 22:03
linux-6.1 UBSAN: shift-out-of-bounds in gfs2_dir_read origin:upstream missing-backport -1 C inconclusive 8 215d 376d 0/3 upstream: reported C repro on 2025/07/15 01:59
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/07/16 15:42 20m anprice@redhat.com git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next OK log
2025/07/16 06:28 14m purvayeshi550@gmail.com patch upstream report log
2025/07/15 14:29 14m purvayeshi550@gmail.com patch upstream report log
2025/07/15 14:15 8m purvayeshi550@gmail.com patch upstream error
2025/07/15 12:24 20m anprice@redhat.com patch upstream report log

Sample crash report:
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5541 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
 dir_e_read fs/gfs2/dir.c:1544 [inline]
 gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
 gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
 iterate_dir+0x5ac/0x770 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:410 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2bedd8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda4c5a0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f2bedfb5fa0 RCX: 00007f2bedd8e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f2bede10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2bedfb5fa0 R14: 00007f2bedfb5fa0 R15: 0000000000000003
 </TASK>
---[ end trace ]---

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/14 19:26 upstream 347e9f5043c8 d8fc7335 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 19:00 upstream 347e9f5043c8 d8fc7335 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 18:30 upstream 347e9f5043c8 d8fc7335 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/18 09:53 upstream 6832a9317eee 0d1223f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/18 09:52 upstream 6832a9317eee 0d1223f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/15 00:17 upstream 347e9f5043c8 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/15 00:17 upstream 347e9f5043c8 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 18:56 upstream 347e9f5043c8 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 18:56 upstream 347e9f5043c8 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/15 07:03 upstream 155a3c003e55 03fcfc4b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 17:13 upstream 347e9f5043c8 d8fc7335 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 19:48 linux-next 0be23810e32e 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
2025/07/14 19:48 linux-next 0be23810e32e 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in gfs2_dir_read
* Struck through repros no longer work on HEAD.