UBSAN: shift-out-of-bounds in do_mpage_readpage

Status: auto-obsoleted due to no activity on 2022/09/29 06:56
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
First crash: 1933d, last: 1768d
Cause bisection: introduced by (bisect log) :
commit dcd479e10a0510522a5d88b29b8f79ea3467d501
Author: Johannes Berg <johannes.berg@intel.com>
Date: Fri Oct 9 12:17:11 2020 +0000

  mac80211: always wind down STA state

Crash: BUG: sleeping function called from invalid context in sta_info_move_state (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[RESEND PATCH v2] loop: fix setting arbitrarily large block size 2 (2) 2021/08/14 07:41
[PATCH] loop: fix setting arbitrarily large block size 6 (6) 2021/07/20 07:25
[syzbot] UBSAN: shift-out-of-bounds in do_mpage_readpage 0 (1) 2021/05/10 12:19
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2022/09/29 05:30 16m retest repro upstream no crash log
2021/08/07 09:51 10m asha.16@itfac.mrt.ac.lk https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2021/06/22 14:50 17m chouhan.shreyansh630@gmail.com patch upstream OK
2021/06/14 19:34 10m chouhan.shreyansh630@gmail.com upstream report log
2021/05/15 15:32 11m h.shahbazi.git@gmail.com patch upstream report log
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2021/11/20 02:02 8h09m bisect fix upstream error job log
2021/10/21 01:29 33m bisect fix upstream OK (0) job log log
2021/09/15 04:24 33m bisect fix upstream OK (0) job log log
2021/07/13 16:00 34m bisect fix upstream OK (0) job log log
2021/06/08 14:14 28m bisect fix upstream OK (0) job log log

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in fs/mpage.c:189:40
shift exponent 4294967279 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 8457 Comm: systemd-udevd Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 do_mpage_readpage.cold+0x226/0x2bb fs/mpage.c:189
 mpage_readahead+0x3a3/0x880 fs/mpage.c:389
 read_pages+0x1df/0x8d0 mm/readahead.c:130
 page_cache_ra_unbounded+0x61f/0x920 mm/readahead.c:238
 do_page_cache_ra mm/readahead.c:267 [inline]
 force_page_cache_ra+0x3ba/0x5b0 mm/readahead.c:299
 page_cache_sync_ra+0x107/0x200 mm/readahead.c:573
 page_cache_sync_readahead include/linux/pagemap.h:864 [inline]
 filemap_get_pages+0x29f/0x1920 mm/filemap.c:2442
 filemap_read+0x2ca/0xe40 mm/filemap.c:2525
 generic_file_read_iter+0x397/0x4f0 mm/filemap.c:2676
 blkdev_read_iter+0x11b/0x180 fs/block_dev.c:1720
 call_read_iter include/linux/fs.h:2110 [inline]
 new_sync_read+0x41e/0x6e0 fs/read_write.c:415
 vfs_read+0x35c/0x570 fs/read_write.c:496
 ksys_read+0x12d/0x250 fs/read_write.c:634
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fdc7280d210
Code: 73 01 c3 48 8b 0d 98 7d 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d b9 c1 20 00 00 75 10 b8 00 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 4e fc ff ff 48 89 04 24
RSP: 002

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/05/08 17:00 upstream d2b6f8a17919 bc5434be .config console log report syz C ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in do_mpage_readpage
2021/09/21 01:19 upstream e4e737bb5c17 af796c18 .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in do_mpage_readpage
2021/08/16 04:20 upstream 7c60610d4767 2489ab88 .config console log report info ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in do_mpage_readpage
2021/06/13 05:53 upstream 8ecfa36cd4db 1ba81399 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in do_mpage_readpage
2021/05/08 15:45 upstream d2b6f8a17919 bc5434be .config console log report info ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in do_mpage_readpage
2021/07/25 02:49 linux-next 90d856e71443 4d1b57d4 .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in do_mpage_readpage
* Struck through repros no longer work on HEAD.