syzbot


UBSAN: shift-out-of-bounds in f2fs_fill_super

Status: fixed on 2021/03/10 01:49
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
Fix commit: e584bbe82122 f2fs: fix shift-out-of-bounds in sanity_check_raw_super()
First crash: 1260d, last: 1260d
Discussions (7)
Title Replies (including bot) Last reply
[PATCH 5.4 00/47] 5.4.87-rc1 review 58 (58) 2021/02/26 14:21
[PATCH 5.10 00/63] 5.10.5-rc1 review 75 (75) 2021/01/07 08:13
[PATCH AUTOSEL 5.10 01/31] ARM: 9014/2: Replace string mem* functions for KASan 37 (37) 2021/01/04 14:29
[PATCH AUTOSEL 5.4 01/17] ARM: 9014/2: Replace string mem* functions for KASan 17 (17) 2020/12/30 13:03
[PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super() 7 (7) 2020/12/10 17:14
[PATCH] f2fs: fix shift-out-of-bounds in sanity_check_raw_super() 1 (1) 2020/12/09 08:49
UBSAN: shift-out-of-bounds in f2fs_fill_super 0 (1) 2020/12/09 07:34
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in f2fs_fill_super (2) f2fs 1 484d 480d 0/26 auto-obsoleted due to no activity on 2023/05/22 14:18
Last patch testing requests (1)
Created Duration User Patch Repo Result
2020/12/09 14:36 16m anant.thazhemadam@gmail.com patch upstream OK

Sample crash report:
loop0: detected capacity change from 16384 to 0
================================================================================
UBSAN: shift-out-of-bounds in fs/f2fs/super.c:2812:16
shift exponent 59 is too large for 32-bit type 'int'
CPU: 0 PID: 8465 Comm: syz-executor962 Not tainted 5.10.0-rc6-next-20201207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 sanity_check_raw_super fs/f2fs/super.c:2812 [inline]
 read_raw_super_block fs/f2fs/super.c:3267 [inline]
 f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519
 mount_bdev+0x34d/0x410 fs/super.c:1366
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1496
 do_new_mount fs/namespace.c:2896 [inline]
 path_mount+0x12ae/0x1e70 fs/namespace.c:3227
 do_mount fs/namespace.c:3240 [inline]
 __do_sys_mount fs/namespace.c:3448 [inline]
 __se_sys_mount fs/namespace.c:3425 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446d4a
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007fff137bba68 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff137bbac0 RCX: 0000000000446d4a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff137bba80
RBP: 00007fff137bba80 R08: 00007fff137bbac0 R09: 00007fff00000015
R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000002
R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
================================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/08 04:36 linux-next 15ac8fdb7440 51a9082e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/12/08 03:46 linux-next 15ac8fdb7440 51a9082e .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 16:21 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 14:24 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.