syzbot


UBSAN: array-index-out-of-bounds in dbAdjTree

Status: upstream: reported C repro on 2022/09/26 09:44
Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com
First crash: 69d, last: 21d

Cause bisection: failed (bisect log)
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: slab-out-of-bounds Read in dbAdjTree C 2 23d 61d 0/1 upstream: reported C repro on 2022/10/03 00:17
linux-4.19 KASAN: use-after-free Read in dbAdjTree C 4 21d 33d 0/1 upstream: reported C repro on 2022/10/31 14:16

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2841:19
index -16119285 is out of range for type 's8 [1365]'
CPU: 1 PID: 120 Comm: jfsCommit Not tainted 6.0.0-syzkaller-09039-ga6afa4199d3d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x50 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:283
 dbAdjTree+0x34c/0x360 fs/jfs/jfs_dmap.c:2841
 dbJoin+0x1f0/0x240 fs/jfs/jfs_dmap.c:2808
 dbFreeBits+0x15d/0x8c0 fs/jfs/jfs_dmap.c:2305
 dbFreeDmap+0x61/0x1a0 fs/jfs/jfs_dmap.c:2054
 dbFree+0x250/0x540 fs/jfs/jfs_dmap.c:379
 txFreeMap+0x8f1/0xd70 fs/jfs/jfs_txnmgr.c:2529
 txUpdateMap+0x3cd/0xc50 fs/jfs/jfs_txnmgr.c:2325
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x610/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
================================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 120 Comm: jfsCommit Not tainted 6.0.0-syzkaller-09039-ga6afa4199d3d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 panic+0x2c8/0x622 kernel/panic.c:274
 ubsan_epilogue+0x4a/0x50 lib/ubsan.c:158
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:283
 dbAdjTree+0x34c/0x360 fs/jfs/jfs_dmap.c:2841
 dbJoin+0x1f0/0x240 fs/jfs/jfs_dmap.c:2808
 dbFreeBits+0x15d/0x8c0 fs/jfs/jfs_dmap.c:2305
 dbFreeDmap+0x61/0x1a0 fs/jfs/jfs_dmap.c:2054
 dbFree+0x250/0x540 fs/jfs/jfs_dmap.c:379
 txFreeMap+0x8f1/0xd70 fs/jfs/jfs_txnmgr.c:2529
 txUpdateMap+0x3cd/0xc50 fs/jfs/jfs_txnmgr.c:2325
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x610/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (20):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2022/10/10 03:46 upstream a6afa4199d3d aea5da89 .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/04 21:04 upstream 4fe89d07dcc2 eab8f949 .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-root 2022/09/25 07:34 upstream 1a61b828566f 0042f2b4 .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/09/25 07:28 upstream 3db61221f4e8 0042f2b4 .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-linux-next-kasan-gce-root 2022/11/06 05:28 linux-next 0cdb3579f1ee 6d752409 .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-linux-next-kasan-gce-root 2022/10/24 05:33 linux-next 4d48f589d294 23bf86af .config log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/11 17:22 upstream 4bbf3422df78 f42ee5d8 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/02 10:21 upstream b229b6ca5abb 08977f5d .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/01 12:34 upstream b229b6ca5abb a1d8560a .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-selinux-root 2022/10/25 02:02 upstream 247f34f7b803 ff2fe65d .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/19 19:55 upstream 493ffd6605b2 b31320fc .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/18 22:39 upstream 493ffd6605b2 b31320fc .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/18 08:30 upstream 493ffd6605b2 94744d21 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 22:39 upstream 493ffd6605b2 94744d21 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 20:43 upstream 493ffd6605b2 94744d21 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 19:04 upstream 493ffd6605b2 94744d21 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-root 2022/10/17 01:12 upstream 55be6084c8e0 67cb024c .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/16 13:11 upstream 493ffd6605b2 67cb024c .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-selinux-root 2022/10/12 00:17 upstream 55be6084c8e0 1353c374 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/10 20:19 upstream 493ffd6605b2 5bcf0c31 .config log report info UBSAN: array-index-out-of-bounds in dbAdjTree
* Struck through repros no longer work on HEAD.