UBSAN: shift-out-of-bounds in dbJoin (2)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
99139c64	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	UBSAN: shift-out-of-bounds in dbJoin (2)	2026/05/23 11:27	2026/05/23 11:27	2026/05/23 12:11	c69befb3

assessment-security

DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

2026/05/23 11:27

2026/05/23 12:11

c69befb3

Title	Replies (including bot)	Last reply
[syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)	1 (6)	2026/04/17 19:19
[PATCH] jfs: Add a sanity check for budmin	1 (1)	2025/12/07 03:52

Title

Replies (including bot)

Last reply

[syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)

1 (6)

2026/04/17 19:19

[PATCH] jfs: Add a sanity check for budmin

1 (1)

2025/12/07 03:52

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	UBSAN: shift-out-of-bounds in dbJoin jfs	-1	C	error		3	1000d	1384d	25/29	fixed on 2024/01/30 15:47

Rank 🛈

upstream

UBSAN: shift-out-of-bounds in dbJoin jfs

-1

error

1000d

1384d

25/29

fixed on 2024/01/30 15:47


Created	Duration	User	Patch	Repo	Result
2026/06/21 08:51	20m	retest repro		upstream	log
2026/06/07 08:54	20m	retest repro		upstream	log
2026/05/08 05:39	28m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	OK log
2026/05/08 05:39	3h06m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	OK log
2026/05/08 05:39	2h55m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	OK log
2026/04/17 19:19	22m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/04/17 16:19	15m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/04/17 10:11	22m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/04/11 04:56	17m	retest repro		upstream	report log
2026/04/11 04:50	14m	retest repro		upstream	report log
2026/03/12 05:20	14m	retest repro		upstream	report log
2026/03/12 05:09	14m	retest repro		upstream	report log
2026/02/26 10:52	33m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	error
2025/12/07 03:18	25m	eadavis@qq.com	patch	upstream	OK log

------------[ cut here ]------------ UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2795:11 shift exponent 132 is too large for 32-bit type 'int' CPU: 0 UID: 0 PID: 123 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494 dbJoin+0x2dc/0x300 fs/jfs/jfs_dmap.c:2795 dbFreeBits+0x4e1/0xdb0 fs/jfs/jfs_dmap.c:2340 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x336/0x650 fs/jfs/jfs_dmap.c:398 txFreeMap+0x7ff/0xde0 fs/jfs/jfs_txnmgr.c:2535 txUpdateMap+0x308/0x9c0 fs/jfs/jfs_txnmgr.c:-1 txLazyCommit fs/jfs/jfs_txnmgr.c:2665 [inline] jfs_lazycommit+0x3f1/0xa10 fs/jfs/jfs_txnmgr.c:2734 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> ---[ end trace ]--- Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 0 UID: 0 PID: 123 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120 vpanic+0x237/0x6d0 kernel/panic.c:489 panic+0xb9/0xc0 kernel/panic.c:626 check_panic_on_warn+0x89/0xb0 kernel/panic.c:376 __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494 dbJoin+0x2dc/0x300 fs/jfs/jfs_dmap.c:2795 dbFreeBits+0x4e1/0xdb0 fs/jfs/jfs_dmap.c:2340 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x336/0x650 fs/jfs/jfs_dmap.c:398 txFreeMap+0x7ff/0xde0 fs/jfs/jfs_txnmgr.c:2535 txUpdateMap+0x308/0x9c0 fs/jfs/jfs_txnmgr.c:-1 txLazyCommit fs/jfs/jfs_txnmgr.c:2665 [inline] jfs_lazycommit+0x3f1/0xa10 fs/jfs/jfs_txnmgr.c:2734 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Kernel Offset: disabled

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/12/03 00:28	upstream	4a26e7032d7d	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	UBSAN: shift-out-of-bounds in dbJoin
2025/12/02 23:17	upstream	4a26e7032d7d	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	UBSAN: shift-out-of-bounds in dbJoin
2025/12/02 20:02	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	05c93f3395ed	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	UBSAN: shift-out-of-bounds in dbJoin
2025/12/02 18:07	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	05c93f3395ed	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	UBSAN: shift-out-of-bounds in dbJoin
2025/12/02 17:18	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	05c93f3395ed	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	UBSAN: shift-out-of-bounds in dbJoin
2025/12/02 16:27	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	05c93f3395ed	d6526ea3	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-gce-arm64	UBSAN: shift-out-of-bounds in dbJoin

Crashes (6):

Assets (help?)