syzbot


UBSAN: shift-out-of-bounds in dbFree

Status: fixed on 2023/09/23 10:26
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+57411692ac6c84ac57cf@syzkaller.appspotmail.com
Fix commit: c7feb54b1138 jfs: jfs_dmap: Validate db_l2nbperpage while mounting
First crash: 585d, last: 521d
Fix bisection: fixed by (bisect log) :
commit c7feb54b113802d2aba98708769d3c33fb017254
Author: Siddh Raman Pant <code@siddh.me>
Date: Tue Jun 20 16:47:00 2023 +0000

  jfs: jfs_dmap: Validate db_l2nbperpage while mounting

  
Bug presence (2)
Date Name Commit Repro Result
2023/05/04 upstream (ToT) 1a5304fecee5 C [report] UBSAN: shift-out-of-bounds in dbFree
2023/08/03 upstream (ToT) ec351c8f2e62 C Didn't crash
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in dbFree jfs C error 3 562d 628d 23/28 fixed on 2023/10/12 12:47
linux-5.15 UBSAN: shift-out-of-bounds in dbFree origin:upstream C done 1 526d 587d 3/3 fixed on 2023/09/19 11:28
Fix bisection attempts (3)
Created Duration User Patch Repo Result
2023/09/19 13:52 3h06m bisect fix linux-6.1.y OK (1) job log
2023/07/05 08:42 1h20m bisect fix linux-6.1.y OK (0) job log log
2023/06/02 00:58 39m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
ERROR: (device loop0): txCommit: 
ERROR: (device loop0): remounting filesystem as read-only
================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:381:12
shift exponent 134217736 is too large for 64-bit type 'long long'
CPU: 0 PID: 3540 Comm: syz-executor912 Not tainted 6.1.27-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 lib/ubsan.c:321
 dbFree+0x46a/0x650 fs/jfs/jfs_dmap.c:381
 txFreeMap+0x966/0xd50 fs/jfs/jfs_txnmgr.c:2510
 xtTruncate+0xe58/0x3260 fs/jfs/jfs_xtree.c:2467
 jfs_free_zero_link+0x46a/0x6e0 fs/jfs/namei.c:758
 jfs_evict_inode+0x35b/0x440 fs/jfs/inode.c:153
 evict+0x2a4/0x620 fs/inode.c:664
 __dentry_kill+0x436/0x650 fs/dcache.c:607
 shrink_dentry_list+0x398/0x6a0 fs/dcache.c:1201
 shrink_dcache_parent+0xc9/0x480
 do_one_tree+0x23/0xe0 fs/dcache.c:1682
 shrink_dcache_for_umount+0x79/0x120 fs/dcache.c:1699
 generic_shutdown_super+0x63/0x340 fs/super.c:473
 kill_block_super+0x7a/0xe0 fs/super.c:1450
 deactivate_locked_super+0xa0/0x110 fs/super.c:332
 cleanup_mnt+0x490/0x520 fs/namespace.c:1186
 task_work_run+0x246/0x300 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x6fb/0x2300 kernel/exit.c:869
 do_group_exit+0x202/0x2b0 kernel/exit.c:1019
 __do_sys_exit_group kernel/exit.c:1030 [inline]
 __se_sys_exit_group kernel/exit.c:1028 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1028
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f544b4c69c9
Code: Unable to access opcode bytes at 0x7f544b4c699f.
RSP: 002b:00007ffe6afb1ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f544b541330 RCX: 00007f544b4c69c9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f544b53be40
R10: 00007ffe6afb1dc0 R11: 0000000000000246 R12: 00007f544b541330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
 </TASK>
================================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/02 06:16 linux-6.1.y ca48fc16c493 62df2017 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan UBSAN: shift-out-of-bounds in dbFree
* Struck through repros no longer work on HEAD.