UBSAN: shift-out-of-bounds in dbUpdatePMap (2)

Status: auto-obsoleted due to no activity on 2023/11/17 21:23
Subsystems: jfs
[Documentation on labels]
Reported-by: syzbot+91ad2b52815a08caf4ea@syzkaller.appspotmail.com
First crash: 1151d, last: 1092d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap 4 (4) 2023/08/30 20:20
[syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbUpdatePMap (2) 0 (1) 2023/06/15 23:03
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: shift-out-of-bounds in dbUpdatePMap -1 syz, C error 2 1117d 1151d 0/3 auto-obsoleted due to no activity on 2023/10/24 09:05
linux-6.1 UBSAN: shift-out-of-bounds in dbUpdatePMap origin:upstream -1 syz, C done 1 1110d 1151d 3/3 fixed on 2023/09/28 03:03
upstream UBSAN: shift-out-of-bounds in dbUpdatePMap jfs -1 syz, C error inconclusive 149 1354d 1405d 0/29 auto-obsoleted due to no activity on 2023/03/01 17:05
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2023/10/03 06:35 16m retest repro upstream OK log
2023/09/03 15:21 32m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log
2023/08/30 08:34 16m ghandatmanas@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.5 OK log
2023/08/26 17:36 31m ghandatmanas@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc5 OK log
2023/08/08 04:10 28m ghandatmanas@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc5 report log
2023/07/26 11:46 32m nogikh@google.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.5-rc3 OK log
2023/07/26 10:50 34m ghandatmanas@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.5-rc3 OK log
2023/07/26 05:39 0m ghandatmanas@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ v6.5-rc3 error

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:470:12
shift exponent 131072 is too large for 64-bit type 'long long'
CPU: 0 PID: 106 Comm: jfsCommit Not tainted 6.4.0-rc5-syzkaller-00313-g4c605260bc60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c3/0x420 lib/ubsan.c:387
 dbUpdatePMap+0xe4e/0xf50 fs/jfs/jfs_dmap.c:470
 txAllocPMap+0x57b/0x6b0 fs/jfs/jfs_txnmgr.c:2420
 txUpdateMap+0x7cc/0x9e0 fs/jfs/jfs_txnmgr.c:2358
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x2b8/0x350 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
================================================================================
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 PID: 106 Comm: jfsCommit Not tainted 6.4.0-rc5-syzkaller-00313-g4c605260bc60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 panic+0x30f/0x770 kernel/panic.c:340
 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236
 ubsan_epilogue lib/ubsan.c:223 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3e2/0x420 lib/ubsan.c:387
 dbUpdatePMap+0xe4e/0xf50 fs/jfs/jfs_dmap.c:470
 txAllocPMap+0x57b/0x6b0 fs/jfs/jfs_txnmgr.c:2420
 txUpdateMap+0x7cc/0x9e0 fs/jfs/jfs_txnmgr.c:2358
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x2b8/0x350 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/11 23:33 upstream 4c605260bc60 49519f06 .config strace log report syz C [mounted in repro] ci2-upstream-fs UBSAN: shift-out-of-bounds in dbUpdatePMap
2023/06/12 03:19 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d8b213732169 7086cdb9 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in dbUpdatePMap
2023/08/09 21:22 upstream cacc6e22932f 13ca4cd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: shift-out-of-bounds in dbUpdatePMap
2023/06/11 22:57 upstream 4c605260bc60 49519f06 .config console log report info ci2-upstream-fs UBSAN: shift-out-of-bounds in dbUpdatePMap
* Struck through repros no longer work on HEAD.