UBSAN: shift-out-of-bounds in ocfs2_fill

Date	Name	Commit	Repro	Result
2024/10/01	upstream (ToT)	e32cde8d2bd7	C	[report] UBSAN: shift-out-of-bounds in ocfs2_fill_super

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	UBSAN: shift-out-of-bounds in ocfs2_fill_super ocfs2	C			199	1d04h	68d	28/28	fixed on 2024/10/22 11:56

upstream

UBSAN: shift-out-of-bounds in ocfs2_fill_super ocfs2

199

1d04h

68d

28/28

fixed on 2024/10/22 11:56

Created	Duration	User	Patch	Repo	Result
2024/10/15 00:49	0m	retest repro		linux-5.15.y	error

Created

Duration

User

Patch

Repo

Result

2024/10/15 00:49

retest repro

linux-5.15.y

error

option from the mount to silence this warning. ======================================================= ================================================================================ UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2342:10 shift exponent 4278976521 is too large for 32-bit type 'int' CPU: 1 PID: 4021 Comm: syz-executor465 Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x2f8/0x378 lib/ubsan.c:321 ocfs2_verify_volume fs/ocfs2/super.c:2342 [inline] ocfs2_sb_probe fs/ocfs2/super.c:793 [inline] ocfs2_fill_super+0xe60/0x498c fs/ocfs2/super.c:989 mount_bdev+0x274/0x370 fs/super.c:1398 ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1187 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1528 do_new_mount+0x278/0x8fc fs/namespace.c:3005 path_mount+0x594/0x101c fs/namespace.c:3335 do_mount fs/namespace.c:3348 [inline] __do_sys_mount fs/namespace.c:3556 [inline] __se_sys_mount fs/namespace.c:3533 [inline] __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3533 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 ================================================================================ ================================================================================ UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2038:24 shift exponent 15990789 is too large for 32-bit type 'int' CPU: 1 PID: 4021 Comm: syz-executor465 Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x2f8/0x378 lib/ubsan.c:321 ocfs2_initialize_super fs/ocfs2/super.c:2038 [inline] ocfs2_fill_super+0x4194/0x498c fs/ocfs2/super.c:995 mount_bdev+0x274/0x370 fs/super.c:1398 ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1187 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1528 do_new_mount+0x278/0x8fc fs/namespace.c:3005 path_mount+0x594/0x101c fs/namespace.c:3335 do_mount fs/namespace.c:3348 [inline] __do_sys_mount fs/namespace.c:3556 [inline] __se_sys_mount fs/namespace.c:3533 [inline] __arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3533 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 ================================================================================ (syz-executor465,4021,1):ocfs2_init_global_system_inodes:462 ERROR: status = -22 (syz-executor465,4021,1):ocfs2_init_global_system_inodes:464 ERROR: Unable to load system inode 2, possibly corrupt fs? (syz-executor465,4021,1):ocfs2_init_global_system_inodes:473 ERROR: status = -22 (syz-executor465,4021,1):ocfs2_initialize_super:2278 ERROR: status = -22 (syz-executor465,4021,1):ocfs2_fill_super:1177 ERROR: status = -22

Crashes (4):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/09/30 23:14	linux-5.15.y	3a5928702e71	bbd4e0a4	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-linux-5-15-kasan-arm64	UBSAN: shift-out-of-bounds in ocfs2_fill_super
2024/09/30 22:00	linux-5.15.y	3a5928702e71	bbd4e0a4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan	UBSAN: shift-out-of-bounds in ocfs2_fill_super
2024/09/30 21:59	linux-5.15.y	3a5928702e71	bbd4e0a4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan	UBSAN: shift-out-of-bounds in ocfs2_fill_super
2024/09/30 21:30	linux-5.15.y	3a5928702e71	bbd4e0a4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan-arm64	UBSAN: shift-out-of-bounds in ocfs2_fill_super

Crashes (4):

Assets (help?)