syzbot

 sign-in | mailing list | source | docs
🐞 Open [1511]
≡ Subsystems
🐞 Fixed [5887]
🐞 Invalid [14312]
⬇ Missing Backports [96]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

UBSAN: shift-out-of-bounds in bch2_alloc_to_text

Status: fixed on 2024/11/14 10:09
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+7f45fa9805c40db3f108@syzkaller.appspotmail.com
Fix commit: 5c41f75d1b92 bcachefs: fix shift oob in alloc_lru_idx_fragmentation
First crash: 48d, last: 32d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in bch2_alloc_to_text 1 (5) 2024/10/26 00:47
[PATCH v3] bcachefs: fix shift oob in alloc_lru_idx_fragmentation 9 (9) 2024/10/24 11:30
[PATCH v2] bcachefs: fix shift oob in alloc_lru_idx_fragmentation 3 (3) 2024/10/21 15:29
[PATCH] bcachefs: fix shift oob in alloc_lru_idx_fragmentation 3 (3) 2024/10/21 15:00
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/10/22 01:34 14m lihongbo22@huawei.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c964ced77262 report log
2024/10/21 13:33 19m gianf.trad@gmail.com patch upstream OK log

Sample crash report:
bcachefs (loop0): bch2_write_super(): fatal error : Unable to write superblock to sufficient devices (from bch2_fs_recovery)
bcachefs (loop0): fatal error - emergency read only
bcachefs (loop0): insufficient writeable journal devices available: have 0, need 1
rw journal devs: loop0
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/alloc_background.h:165:13
shift exponent 129 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 5825 Comm: syz-executor407 Not tainted 6.12.0-rc5-syzkaller-00063-g0fc810ae3ae1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 data_type_movable fs/bcachefs/alloc_background.h:165 [inline]
 alloc_lru_idx_fragmentation fs/bcachefs/alloc_background.h:171 [inline]
 bch2_alloc_to_text+0xc79/0xce0 fs/bcachefs/alloc_background.c:369
 __bch2_bkey_fsck_err+0x1c8/0x280 fs/bcachefs/error.c:457
 bch2_alloc_v4_validate+0x931/0xef0 fs/bcachefs/alloc_background.c:259
 bch2_btree_node_read_done+0x3e7e/0x5e90 fs/bcachefs/btree_io.c:1223
 btree_node_read_work+0x68b/0x1260 fs/bcachefs/btree_io.c:1327
 bch2_btree_node_read+0x2433/0x2a10
 __bch2_btree_root_read fs/bcachefs/btree_io.c:1753 [inline]
 bch2_btree_root_read+0x617/0x7a0 fs/bcachefs/btree_io.c:1775
 read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:524
 bch2_fs_recovery+0x2585/0x39c0 fs/bcachefs/recovery.c:854
 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036
 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
 vfs_get_tree+0x90/0x2b0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4057 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f703e8bc8fa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc17ef5508 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc17ef5520 RCX: 00007f703e8bc8fa
RDX: 00000000200058c0 RSI: 0000000020000100 RDI: 00007ffc17ef5520
RBP: 0000000000000004 R08: 00007ffc17ef5560 R09: 00000000000058c6
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 00007ffc17ef5560 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
---[ end trace ]---

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/01 03:37 upstream 0fc810ae3ae1 96eb609f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/17 08:31 upstream c964ced77262 666f77ed .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/17 07:48 upstream c964ced77262 666f77ed .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/17 07:13 upstream c964ced77262 666f77ed .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/31 16:58 upstream 0fc810ae3ae1 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/11/02 00:12 upstream 6c52d4da1c74 f00eed24 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/31 01:28 upstream 4236f913808c fb888278 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/30 01:45 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/29 18:02 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/29 10:28 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/29 09:09 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/29 04:50 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/29 02:40 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/28 11:11 upstream 819837584309 65e8686b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/27 01:01 upstream 850925a8133c 65e8686b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/26 18:20 upstream 850925a8133c 65e8686b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/26 02:34 upstream c71f8fb4dc91 65e8686b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/25 16:10 upstream ae90f6a6170d 2a61f980 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/23 22:30 upstream c2ee9f594da8 15fa2979 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/23 17:57 upstream c2ee9f594da8 15fa2979 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/23 16:42 upstream c2ee9f594da8 15fa2979 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/22 20:31 upstream c2ee9f594da8 a573a9f4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/22 04:56 upstream c2ee9f594da8 a93682b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/21 03:10 upstream db87114dcf13 cd6fc0a3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/21 01:38 upstream db87114dcf13 cd6fc0a3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/20 23:15 upstream db87114dcf13 cd6fc0a3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/18 10:08 upstream 4d939780b705 666f77ed .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/10/17 06:39 upstream c964ced77262 666f77ed .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in bch2_alloc_to_text
2024/11/02 15:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5283dc78f4da f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in bch2_alloc_to_text
* Struck through repros no longer work on HEAD.