UBSAN: array-index-out-of-bounds in f2fs_iget

Status: fixed on 2023/10/10 21:47
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+9310fd5227844fb4dafc@syzkaller.appspotmail.com
Fix commit: 0d545a8e77cb Revert "f2fs: fix to do sanity check on extent cache correctly"
First crash: 1088d, last: 1088d
Fix bisection: fixed by (bisect log) :
commit 0d545a8e77cbd1fbad311b18952e38e0f7672ab4
Author: Chao Yu <chao@kernel.org>
Date: Thu Jul 20 11:29:53 2023 +0000

  Revert "f2fs: fix to do sanity check on extent cache correctly"

  
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2023/08/30 upstream (ToT) d68b4b6f307d C [report] UBSAN: array-index-out-of-bounds in f2fs_iget
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in f2fs_iget f2fs 15 syz, C done 6 1075d 1120d 23/29 fixed on 2023/10/12 12:48
android-5-15 KASAN: use-after-free Read in f2fs_iget origin:lts 19 syz, C error 1 205d 219d 0/2 upstream: reported C repro on 2026/01/06 01:52
android-5-10 KASAN: use-after-free Read in f2fs_iget 19 syz, C error 1 181d 368d 0/2 upstream: reported C repro on 2025/08/09 12:12
linux-5.15 KASAN: use-after-free Read in f2fs_iget missing-backport origin:lts-only 19 syz, C error 6 17d 829d 0/3 upstream: reported C repro on 2024/05/05 12:48

Sample crash report:
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): Found nat_bits in checkpoint
================================================================================
UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3257:19
index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
CPU: 1 PID: 4219 Comm: syz-executor128 Not tainted 6.1.46-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_out_of_bounds+0xfc/0x148 lib/ubsan.c:282
 inline_data_addr fs/f2fs/f2fs.h:3257 [inline]
 __recover_inline_status fs/f2fs/inode.c:111 [inline]
 do_read_inode fs/f2fs/inode.c:402 [inline]
 f2fs_iget+0x43a0/0x4938 fs/f2fs/inode.c:519
 f2fs_fill_super+0x4d88/0x6338 fs/f2fs/super.c:4356
 mount_bdev+0x274/0x370 fs/super.c:1432
 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4595
 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
 vfs_get_tree+0x90/0x274 fs/super.c:1562
 do_new_mount+0x25c/0x8c4 fs/namespace.c:3040
 path_mount+0x590/0xe58 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
================================================================================
F2FS-fs (loop0): sanity_check_inode: inode (ino=3) is with extra_attr, but extra_attr feature is off
F2FS-fs (loop0): Failed to read root inode

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/08/20 21:19 linux-6.1.y 6c44e13dc284 d216d8a0 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in f2fs_iget
* Struck through repros no longer work on HEAD.