syzbot


UBSAN: shift-out-of-bounds in __btree_node_pinned

Status: upstream: reported C repro on 2024/10/02 10:54
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+9f41e4b255897d99d4e9@syzkaller.appspotmail.com
First crash: 53d, last: 53d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH v1] bcachefs: add check for btree id against max in try read node 4 (4) 2024/10/07 19:15
[syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in __btree_node_pinned 0 (3) 2024/10/04 21:48
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/10/12 14:35 16m retest repro upstream report log
2024/10/04 21:48 16m niharchaithanya@gmail.com patch upstream report log
2024/10/04 19:54 17m niharchaithanya@gmail.com patch upstream report log

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/btree_cache.c:198:18
shift exponent 227 is too large for 64-bit type 'unsigned long long'
CPU: 0 UID: 0 PID: 5109 Comm: read_btree_node Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 __btree_node_pinned+0x80b/0x850 fs/bcachefs/btree_cache.c:198
 __bch2_btree_node_hash_insert+0xcfd/0x13e0 fs/bcachefs/btree_cache.c:270
 bch2_btree_node_hash_insert fs/bcachefs/btree_cache.c:287 [inline]
 bch2_btree_node_fill+0x94e/0x1200 fs/bcachefs/btree_cache.c:932
 bch2_btree_node_get_noiter+0x9d5/0xf70 fs/bcachefs/btree_cache.c:1238
 found_btree_node_is_readable fs/bcachefs/btree_node_scan.c:85 [inline]
 try_read_btree_node fs/bcachefs/btree_node_scan.c:190 [inline]
 read_btree_nodes_worker+0x122c/0x20b0 fs/bcachefs/btree_node_scan.c:239
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 5109 Comm: read_btree_node Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 panic+0x349/0x880 kernel/panic.c:354
 check_panic_on_warn+0x86/0xb0 kernel/panic.c:243
 ubsan_epilogue lib/ubsan.c:236 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3e7/0x420 lib/ubsan.c:468
 __btree_node_pinned+0x80b/0x850 fs/bcachefs/btree_cache.c:198
 __bch2_btree_node_hash_insert+0xcfd/0x13e0 fs/bcachefs/btree_cache.c:270
 bch2_btree_node_hash_insert fs/bcachefs/btree_cache.c:287 [inline]
 bch2_btree_node_fill+0x94e/0x1200 fs/bcachefs/btree_cache.c:932
 bch2_btree_node_get_noiter+0x9d5/0xf70 fs/bcachefs/btree_cache.c:1238
 found_btree_node_is_readable fs/bcachefs/btree_node_scan.c:85 [inline]
 try_read_btree_node fs/bcachefs/btree_node_scan.c:190 [inline]
 read_btree_nodes_worker+0x122c/0x20b0 fs/bcachefs/btree_node_scan.c:239
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/28 14:33 upstream ad46e8f95e93 ba29ff75 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
2024/09/28 10:45 upstream e477dba5442c 440b26ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
* Struck through repros no longer work on HEAD.