UBSAN: shift-out-of-bounds in dbFindBits (2)

Status: upstream: reported C repro on 2024/10/25 06:49
Subsystems: jfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
First crash: 696d, last: 1d15h
▶ ▼ ✨ AI Patch Versions (1)
Version Stage Reported Report Link Job
1 moderation 2026/05/29 14:32 Discussion 665e737f-2256-468b-a1a9-fd1d4b2ebf38
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
665e737f patching ❓ UBSAN: shift-out-of-bounds in dbFindBits (2) 2026/05/29 14:07 2026/05/29 14:07 2026/05/29 14:32 6b4a8443
c23bdd78 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ UBSAN: shift-out-of-bounds in dbFindBits (2) 2026/05/22 05:11 2026/05/22 05:11 2026/05/22 05:42 70ae9b03
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) 0 (2) 2025/09/28 01:00
[PATCH v4] jfs: UBSAN: shift-out-of-bounds in dbFindBits 2 (3) 2024/12/02 20:53
[PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits 2 (3) 2024/10/30 15:15
Re: [syzbot] [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits 0 (1) 2024/10/25 16:30
[PATCH v2] jfs: UBSAN: shift-out-of-bounds in dbFindBits 1 (2) 2024/10/25 15:39
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in dbFindBits jfs -1 syz, C error 53 698d 802d 28/29 fixed on 2024/10/22 11:57
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2026/08/30 08:20 14m retest repro upstream error job log
2026/08/30 08:20 15m retest repro upstream error job log
2026/08/30 08:20 15m retest repro upstream report job log log
2026/05/11 17:09 21m retest repro upstream error
2026/03/08 20:05 18m retest repro upstream error
2026/02/15 02:27 16m retest repro upstream log
2026/01/15 06:43 20m retest repro upstream no crash log
2025/12/28 19:41 16m retest repro upstream report log
2025/12/07 02:07 16m retest repro upstream report log
2025/11/06 06:23 14m retest repro upstream report log
2025/09/28 01:00 14m xandfury@gmail.com upstream report log
2024/11/01 10:00 19m zoo868e@gmail.com patch upstream OK log
2024/10/25 17:00 19m zoo868e@gmail.com patch upstream OK log
2024/10/25 16:30 19m zoo868e@gmail.com patch upstream OK log
2024/10/25 15:25 13m zoo868e@gmail.com patch upstream report log

Sample crash report:
ERROR: (device loop0): remounting filesystem as read-only
ERROR: (device loop0): dbDiscardAG: -EIO
ERROR: (device loop0): dbAllocBits: leaf page corrupt
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:3118:55
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5522 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:494
 dbFindBits+0xdf/0x1a0 fs/jfs/jfs_dmap.c:3118
 dbAllocDmapLev+0x161/0x3b0 fs/jfs/jfs_dmap.c:2072
 dbAllocCtl+0x145/0x990 fs/jfs/jfs_dmap.c:1912
 dbAllocAG+0x1f4/0xf80 fs/jfs/jfs_dmap.c:1440
 dbDiscardAG+0x2d6/0x8f0 fs/jfs/jfs_dmap.c:1695
 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:106
 jfs_ioctl+0x28e/0x3b0 fs/jfs/ioctl.c:131
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa24499de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff1322f9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa244c25fa0 RCX: 00007fa24499de59
RDX: 0000200000000080 RSI: 00000000c0185879 RDI: 0000000000000004
RBP: 00007fa244a33e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa244c25fac R14: 00007fa244c25fa0 R15: 00007fa244c25fa0
 </TASK>
---[ end trace ]---

Crashes (217):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/11 20:04 upstream dd3210c47e8d d78ea535 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2025/10/05 18:42 upstream 6093a688a07d 49379ee0 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2025/02/01 07:56 upstream 69e858e0b8b2 aa47157c .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/16 22:22 upstream 9b87fdc9af2f b0e4c57e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/15 17:26 upstream 587858367581 f41e228a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/14 21:58 upstream 704340f1cd0d 924033e8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/14 16:46 upstream 704340f1cd0d 924033e8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/14 06:15 upstream d681d7ef617e 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/14 03:54 upstream d681d7ef617e 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/13 01:00 upstream 5225b8eec4c9 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/12 22:46 upstream 5225b8eec4c9 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/12 11:50 upstream 827751b699b7 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/12 08:11 upstream 827751b699b7 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/11 01:24 upstream 50d05c7c76c9 1fe56c0a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/10 14:54 upstream 50d05c7c76c9 1fe56c0a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/09 18:36 upstream 893e11787f78 edec9137 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/09 14:26 upstream 893e11787f78 edec9137 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/06 19:41 upstream 1fc5a74b108f 4f7b22a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/09/05 08:11 upstream 654ae5d73c05 4f7b22a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/08/16 08:16 upstream 3eb40771c00a 746171ee .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/08/08 20:46 upstream a59f57e2aa12 5d63f80b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/08/08 04:03 upstream 3f008280327b 5d63f80b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/08/06 02:28 upstream 0d8395707651 cd5b1963 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/30 05:54 upstream fc46aed51f62 2377cd3d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/28 07:27 upstream 62cc90241548 45ae1df4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/22 02:27 upstream 248951ddc14d b561ce9c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/21 17:58 upstream b95f03f04d47 7c5de9c3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/19 08:26 upstream f2ec6312bf71 72524a66 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/14 07:22 upstream 0f26556c5eee 2130f682 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/13 18:47 upstream a13c140cc289 a870962e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/12 13:00 upstream 44696aa3a489 d78ea535 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/11 18:59 upstream dd3210c47e8d d78ea535 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/08 08:13 upstream 0e35b9b6ec0f 88a4b44c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/04 11:01 upstream 71dfdfb0209b fcece630 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/04 08:04 upstream 71dfdfb0209b fcece630 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/03 23:39 upstream d2c9a99135da aa437a8a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/07/03 07:58 upstream 87320be9f0d2 58bf2096 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/29 15:04 upstream dc59e4fea9d8 6a0c72dc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/24 08:52 upstream f31c00c377cc 042555ff .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/23 05:11 upstream 4708cac0e22c 5a630be6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/22 01:41 upstream 8cd8cf7a07e5 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/20 18:52 upstream 1a3746ccbb0a 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/20 11:09 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/20 05:59 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/20 02:04 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/19 07:23 upstream 83f1454877cc d7ffd47b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/18 16:49 upstream e771677c937d a776b0d0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/17 07:44 upstream 6b5a2b7d9bc1 62cc6db3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/17 02:15 upstream 6b5a2b7d9bc1 62cc6db3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2026/06/14 07:47 upstream 2b07ea76fd28 4f06757f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
2024/10/22 13:13 upstream c2ee9f594da8 a93682b3 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in dbFindBits
* Struck through repros no longer work on HEAD.