UBSAN: shift-out-of-bounds in dbFree

Date	Name	Commit	Repro	Result
2023/05/06	upstream (ToT)	dd9e11d6477a	C	[report] UBSAN: shift-out-of-bounds in dbFree
2023/08/05	upstream (ToT)	024ff300db33	C	Didn't crash

Date

Name

Commit

Repro

Result

2023/05/06

upstream (ToT)

dd9e11d6477a

[report] UBSAN: shift-out-of-bounds in dbFree

2023/08/05

upstream (ToT)

024ff300db33

Didn't crash

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	UBSAN: shift-out-of-bounds in dbFree jfs	-1	syz, C	error		3	1161d	1227d	23/29	fixed on 2023/10/12 12:47
linux-6.1	UBSAN: shift-out-of-bounds in dbFree origin:upstream	-1	syz, C		done	1	1120d	1185d	3/3	fixed on 2023/09/23 10:26

Rank 🛈

upstream

UBSAN: shift-out-of-bounds in dbFree jfs

-1

syz, C

error

1161d

1227d

23/29

fixed on 2023/10/12 12:47

linux-6.1

UBSAN: shift-out-of-bounds in dbFree origin:upstream

-1

syz, C

done

1120d

1185d

3/3

fixed on 2023/09/23 10:26


Created	Duration	User	Repo	Result
2023/09/14 12:28	4h49m	bisect fix	linux-5.15.y	OK (1) job log
2023/06/30 19:32	1h31m	bisect fix	linux-5.15.y	OK (0) job log log
2023/05/31 07:49	42m	bisect fix	linux-5.15.y	OK (0) job log log

find_entry called with index = 0 read_mapping_page failed! ERROR: (device loop0): txCommit: ERROR: (device loop0): remounting filesystem as read-only ================================================================================ UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:381:12 shift exponent 134217736 is too large for 64-bit type 'long long' CPU: 1 PID: 3498 Comm: syz-executor324 Not tainted 5.15.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 lib/ubsan.c:321 dbFree+0x46a/0x650 fs/jfs/jfs_dmap.c:381 txFreeMap+0x966/0xd50 fs/jfs/jfs_txnmgr.c:2544 xtTruncate+0xe58/0x3260 fs/jfs/jfs_xtree.c:3428 jfs_free_zero_link+0x46a/0x6e0 fs/jfs/namei.c:758 jfs_evict_inode+0x35b/0x440 fs/jfs/inode.c:153 evict+0x2a4/0x620 fs/inode.c:587 __dentry_kill+0x436/0x650 fs/dcache.c:582 shrink_dentry_list+0x398/0x6a0 fs/dcache.c:1176 shrink_dcache_parent+0xc9/0x480 do_one_tree+0x23/0xe0 fs/dcache.c:1657 shrink_dcache_for_umount+0x79/0x120 fs/dcache.c:1674 generic_shutdown_super+0x66/0x2c0 fs/super.c:447 kill_block_super+0x7a/0xe0 fs/super.c:1405 deactivate_locked_super+0xa0/0x110 fs/super.c:335 cleanup_mnt+0x44e/0x500 fs/namespace.c:1143 task_work_run+0x129/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:872 do_group_exit+0x144/0x310 kernel/exit.c:994 __do_sys_exit_group kernel/exit.c:1005 [inline] __se_sys_exit_group kernel/exit.c:1003 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f4af666a9c9 Code: Unable to access opcode bytes at RIP 0x7f4af666a99f. RSP: 002b:00007ffed1092878 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f4af66e5330 RCX: 00007f4af666a9c9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f4af66dfe40 R10: 00007ffed1092790 R11: 0000000000000246 R12: 00007f4af66e5330 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK> ================================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/04/30 05:12	linux-5.15.y	f48aeeaaa64c	62df2017	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-linux-5-15-kasan	UBSAN: shift-out-of-bounds in dbFree

Crashes (1):

Assets (help?)