syzbot

 sign-in | mailing list | source | docs
🐞 Open [1158] ≡ Subsystems 🐞 Fixed [4412] 🐞 Invalid [9929] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: array-index-out-of-bounds in dbAdjTree

Status: upstream: reported C repro on 2022/09/26 09:44
Subsystems: jfs (incorrect?)
Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com
First crash: 186d, last: 3d04h

Cause bisection: failed (error log, bisect log)
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: slab-out-of-bounds Read in dbAdjTree C 3 31d 178d 0/1 upstream: reported C repro on 2022/10/03 00:17
linux-4.19 KASAN: use-after-free Read in dbAdjTree C error 5 33d 150d 0/1 upstream: reported C repro on 2022/10/31 14:16

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2856:6
index 1668573185 is out of range for type 's8[1365]' (aka 'signed char[1365]')
CPU: 1 PID: 105 Comm: jfsCommit Not tainted 6.2.0-syzkaller-10443-g8cbd92339db0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2856
 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2823
 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2320
 dbFreeDmap fs/jfs/jfs_dmap.c:2069 [inline]
 dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:394
 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2529
 txUpdateMap+0x342/0x9e0
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x270/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
================================================================================
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 1 PID: 105 Comm: jfsCommit Not tainted 6.2.0-syzkaller-10443-g8cbd92339db0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 panic+0x31c/0x770 kernel/panic.c:319
 check_panic_on_warn+0x82/0xa0 kernel/panic.c:239
 ubsan_epilogue lib/ubsan.c:223 [inline]
 __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348
 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2856
 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2823
 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2320
 dbFreeDmap fs/jfs/jfs_dmap.c:2069 [inline]
 dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:394
 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2529
 txUpdateMap+0x342/0x9e0
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x270/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-fs 2023/03/27 11:41 upstream 197b6b60ae7b ee50e71c .config console log report syz C
ci-upstream-kasan-gce-root 2023/02/14 13:37 upstream f6feea56f66d aea5da89 .config console log report syz C
* Struck through repros no longer work on HEAD.
Crashes (23):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-fs 2023/02/25 10:53 upstream 8cbd92339db0 ee50e71c .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-root 2022/10/10 03:46 upstream a6afa4199d3d aea5da89 .config strace log report syz C [disk image] [vmlinux] [mounted in repro] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/04 21:04 upstream 4fe89d07dcc2 eab8f949 .config strace log report syz C [disk image] [vmlinux] [mounted in repro] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-root 2022/09/25 07:34 upstream 1a61b828566f 0042f2b4 .config strace log report syz C [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/09/25 07:28 upstream 3db61221f4e8 0042f2b4 .config strace log report syz C UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-linux-next-kasan-gce-root 2022/11/06 05:28 linux-next 0cdb3579f1ee 6d752409 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-linux-next-kasan-gce-root 2022/10/24 05:33 linux-next 4d48f589d294 23bf86af .config strace log report syz C [disk image] [vmlinux] [mounted in repro] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2023/02/25 09:36 upstream 8cbd92339db0 ee50e71c .config console log report info [disk image] [vmlinux] [kernel image] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2023/01/15 13:14 upstream 7c6984405241 a63719e7 .config console log report info [disk image] [vmlinux] [kernel image] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/11 17:22 upstream 4bbf3422df78 f42ee5d8 .config console log report info [disk image] [vmlinux] [kernel image] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/02 10:21 upstream b229b6ca5abb 08977f5d .config console log report info [disk image] [vmlinux] [kernel image] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/11/01 12:34 upstream b229b6ca5abb a1d8560a .config console log report info [disk image] [vmlinux] [kernel image] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-selinux-root 2022/10/25 02:02 upstream 247f34f7b803 ff2fe65d .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/19 19:55 upstream 493ffd6605b2 b31320fc .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/18 22:39 upstream 493ffd6605b2 b31320fc .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/18 08:30 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 22:39 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 20:43 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/17 19:04 upstream 493ffd6605b2 94744d21 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-root 2022/10/17 01:12 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/16 13:11 upstream 493ffd6605b2 67cb024c .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci-upstream-kasan-gce-selinux-root 2022/10/12 00:17 upstream 55be6084c8e0 1353c374 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
ci2-upstream-fs 2022/10/10 20:19 upstream 493ffd6605b2 5bcf0c31 .config console log report info [disk image] [vmlinux] UBSAN: array-index-out-of-bounds in dbAdjTree
* Struck through repros no longer work on HEAD.