UBSAN: shift-out-of-bounds in extAlloc

Status: auto-obsoleted due to no activity on 2026/04/18 15:14
Reported-by: syzbot+6263abc344ae6ff3384e@syzkaller.appspotmail.com
First crash: 207d, last: 207d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in extAlloc jfs -1 syz, C error 6605 1048d 1408d 23/29 fixed on 2023/10/12 12:47
linux-5.15 UBSAN: shift-out-of-bounds in extAlloc (2) origin:upstream -1 syz, C error 1 17d 447d 0/3 upstream: reported C repro on 2025/05/14 03:45
linux-5.15 UBSAN: shift-out-of-bounds in extAlloc origin:upstream -1 syz, C done 217 1051d 1243d 3/3 fixed on 2023/10/20 00:28
linux-6.1 UBSAN: shift-out-of-bounds in extAlloc origin:upstream missing-backport -1 syz, C done 204 476d 1240d 3/3 fixed on 2025/05/02 07:04
upstream UBSAN: shift-out-of-bounds in extAlloc (2) prio:high jfs -1 syz, C inconclusive 13 21d 823d 0/29 upstream: reported C repro on 2024/05/03 13:40

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_extent.c:319:16
shift exponent 94 is too large for 64-bit type 's64' (aka 'long long')
CPU: 0 PID: 6093 Comm: syz.2.52 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_shift_out_of_bounds+0x380/0x400 lib/ubsan.c:387
 extBalloc fs/jfs/jfs_extent.c:319 [inline]
 extAlloc+0xcbf/0xf30 fs/jfs/jfs_extent.c:122
 jfs_get_block+0x347/0xab0 fs/jfs/inode.c:254
 __block_write_begin_int+0x566/0x1ad0 fs/buffer.c:2124
 __block_write_begin fs/buffer.c:2173 [inline]
 block_write_begin+0x9a/0x1e0 fs/buffer.c:2234
 jfs_write_begin+0x35/0x70 fs/jfs/inode.c:305
 generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4031
 generic_file_write_iter+0xaf/0x2e0 mm/filemap.c:4152
 __kernel_write_iter+0x274/0x670 fs/read_write.c:517
 dump_emit_page fs/coredump.c:957 [inline]
 dump_user_range+0x3f6/0x800 fs/coredump.c:984
 elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
 do_coredump+0x1755/0x2480 fs/coredump.c:833
 get_signal+0x1133/0x1400 kernel/signal.c:2888
 arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
 exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fa95e78f751
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fa95e9e5fa0 RCX: 00007fa95e78f749
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007fa95e813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fa95e9e6038 R14: 00007fa95e9e5fa0 R15: 00007fffcb892028
 </TASK>
================================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/08 15:13 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan UBSAN: shift-out-of-bounds in extAlloc
* Struck through repros no longer work on HEAD.