UBSAN: shift-out-of-bounds in ocfs2_fill_super

Status: upstream: reported C repro on 2024/09/30 21:30
Bug presence: origin:lts-only
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+c6104ecfe56e0fd6b616@syzkaller.appspotmail.com
First crash: 752d, last: 11d
Fix commit to backport (bisect log) :
tree: upstream
commit 7f86b2942791012ac7b4c481d1f84a58fd2fbcfc
Author: qasdev <qasdev00@gmail.com>
Date: Tue Aug 20 01:22:09 2024 +0000

  ocfs2: fix shift-out-of-bounds UBSAN bug in ocfs2_verify_volume()

  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 5.15.y] ocfs2: fix shift-out-of-bounds UBSAN bug in ocfs2_verify_volume 2 (2) 2026/04/23 11:53
[PATCH] iomap: don't invalidate folios after writeback errors 1 (1) 2026/03/24 13:45
[PATCH 5.15.y] ocfs2: fix shift-out-of-bounds UBSAN bug in ocfs2_verify_volume 2 (2) 2026/03/24 07:45
Re: [syzbot] ocfs2: shift-out-of-bounds UBSAN bug in ocfs2_verify_volume 1 (2) 2026/03/24 03:40
Re: [syzbot] ocfs2: shift-out-of-bounds UBSAN bug in ocfs2_verify_volume 1 (2) 2026/03/23 13:16
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/01/20 linux-5.15.y (ToT) 4735586da88e C [report] UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/01/20 upstream (ToT) 100ceb4817a2 C Didn't crash
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in ocfs2_fill_super ocfs2 -1 syz, C 199 731d 799d 28/29 fixed on 2024/10/22 11:56
linux-6.6 UBSAN: shift-out-of-bounds in ocfs2_fill_super origin:lts-only -1 syz, C inconclusive 23 86d 451d 0/2 upstream: reported C repro on 2025/07/29 03:00
upstream UBSAN: shift-out-of-bounds in ocfs2_fill_super (2) ocfs2 -1 syz, C 81 705d 726d 28/29 fixed on 2024/12/16 09:50
linux-6.1 UBSAN: shift-out-of-bounds in ocfs2_fill_super origin:lts-only -1 syz, C error 126 11d 726d 0/3 upstream: reported C repro on 2024/10/27 03:28
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/09/13 09:21 1h00m retest repro linux-5.15.y report job log log
2026/08/23 18:37 23m retest repro linux-5.15.y report job log log
2026/08/23 18:37 21m retest repro linux-5.15.y report job log log
2026/08/23 18:37 13m retest repro linux-5.15.y report job log log
2026/06/25 13:29 21m retest repro linux-5.15.y report log
2026/05/05 06:13 22m retest repro linux-5.15.y report log
2026/05/05 06:13 16m retest repro linux-5.15.y report log
2026/04/17 12:29 10m retest repro linux-5.15.y report log
2026/04/03 04:06 10m retest repro linux-5.15.y report log
2026/03/24 03:23 15m 1016331059@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 3330a8d33e086f76608bb4e80a3dc569d04a8814 OK log
2026/03/23 12:38 0m 1016331059@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 3330a8d33e086f76608bb4e80a3dc569d04a8814 error
2026/02/20 02:47 21m retest repro linux-5.15.y report log
▶ ▼ Fix bisection attempts (4)
Created Duration User Patch Repo Result
2025/02/21 05:02 6h25m fix candidate upstream OK (1) job log
2024/12/31 22:38 8m fix candidate upstream error job log
2024/11/19 13:11 1m fix candidate upstream error job log
2024/10/31 17:37 1m bisect fix linux-5.15.y error job log

Sample crash report:
WARNING: The mand mount option has been deprecated and
         and is ignored by this kernel. Remove the mand
         option from the mount to silence this warning.
=======================================================
================================================================================
UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2370:4
shift exponent 1593835534 is too large for 32-bit type 'int'
CPU: 1 PID: 4316 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 lib/ubsan.c:321
 ocfs2_verify_volume fs/ocfs2/super.c:2371 [inline]
 ocfs2_sb_probe fs/ocfs2/super.c:793 [inline]
 ocfs2_fill_super+0xedd/0x50a0 fs/ocfs2/super.c:989
 mount_bdev+0x28a/0x3c0 fs/super.c:1411
 legacy_get_tree+0xe6/0x180 fs/fs_context.c:611
 vfs_get_tree+0x88/0x270 fs/super.c:1541
 do_new_mount+0x247/0xa40 fs/namespace.c:3034
 do_mount fs/namespace.c:3377 [inline]
 __do_sys_mount fs/namespace.c:3585 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f969a7c644a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec229db18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffec229dba0 RCX: 00007f969a7c644a
RDX: 0000200000004440 RSI: 0000200000000040 RDI: 00007ffec229db60
RBP: 0000200000004440 R08: 00007ffec229dba0 R09: 00000000000008c0
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000200000000040
R13: 00007ffec229db60 R14: 000000000000445d R15: 0000200000000080
 </TASK>
================================================================================

Crashes (101):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/11 16:27 linux-5.15.y a051a4bf909f 4f92358f .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/04/20 10:52 linux-5.15.y b9d57c40a767 303e2802 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/10/11 20:19 linux-5.15.y 29e53a5b1c4f ff1712fe .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/01/20 01:04 linux-5.15.y 4735586da88e f2cb035c .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/05/17 17:23 linux-5.15.y 3b8db0e4f263 f41472b0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/10/11 15:32 linux-5.15.y a051a4bf909f 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/28 08:05 linux-5.15.y 674f684f7c61 45ae1df4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/19 00:11 linux-5.15.y c86c4726e7f0 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/08 16:29 linux-5.15.y c86c4726e7f0 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/07/06 22:35 linux-5.15.y c86c4726e7f0 88b240e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/06/29 19:33 linux-5.15.y eceeec79dbc6 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/06/01 06:29 linux-5.15.y 241d66fa280c 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/04/20 10:07 linux-5.15.y b9d57c40a767 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/08 21:48 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/06 18:25 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/06 16:01 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2026/01/04 09:28 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/28 20:27 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/22 14:39 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/12/03 20:43 linux-5.15.y cc5ec8769306 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/11/10 02:51 linux-5.15.y cc5ec8769306 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/10/29 09:29 linux-5.15.y ac56c046adf4 fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/10/11 20:03 linux-5.15.y 29e53a5b1c4f ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/29 03:40 linux-5.15.y c79648372d02 6654ea9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/04/27 10:07 linux-5.15.y f7347f400572 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/27 21:29 linux-5.15.y 0c935c049b5c 6c09fb82 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/10 11:42 linux-5.15.y c16c81c81336 163f510d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/08 06:24 linux-5.15.y c16c81c81336 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/30 21:18 linux-5.15.y c79648372d02 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/28 21:25 linux-5.15.y c79648372d02 6654ea9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/26 10:40 linux-5.15.y c79648372d02 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/14 01:55 linux-5.15.y 2f693b607545 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/07/11 16:02 linux-5.15.y 2f693b607545 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/06/08 03:41 linux-5.15.y 1c700860e8bc 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/05/17 16:49 linux-5.15.y 3b8db0e4f263 f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/04/27 04:27 linux-5.15.y f7347f400572 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/04/26 23:33 linux-5.15.y f7347f400572 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/04/26 10:52 linux-5.15.y f7347f400572 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/04/03 00:52 linux-5.15.y 0c935c049b5c c799dfdd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/30 10:31 linux-5.15.y 0c935c049b5c d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/28 23:52 linux-5.15.y 0c935c049b5c 9a1a9e31 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/27 10:15 linux-5.15.y 0c935c049b5c 20510e88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/10 22:46 linux-5.15.y c16c81c81336 16256247 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/08 04:41 linux-5.15.y c16c81c81336 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/08 04:41 linux-5.15.y c16c81c81336 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/07 06:25 linux-5.15.y c16c81c81336 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2025/03/03 20:50 linux-5.15.y c16c81c81336 c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2024/09/30 23:14 linux-5.15.y 3a5928702e71 bbd4e0a4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
2024/09/30 21:30 linux-5.15.y 3a5928702e71 bbd4e0a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 UBSAN: shift-out-of-bounds in ocfs2_fill_super
* Struck through repros no longer work on HEAD.