UBSAN: shift-out-of-bounds in filemap_get_entry

Status: auto-obsoleted due to no activity on 2025/05/17 03:34
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+a0ae55e3dde11d2d790c@syzkaller.appspotmail.com
First crash: 571d, last: 564d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [mm?] [bcachefs?] KASAN: slab-out-of-bounds Read in folio_try_get 2 (4) 2025/07/20 04:04
[syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in filemap_get_entry 2 (3) 2025/02/03 04:29
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2025/05/01 05:57 19m retest repro upstream no crash log
2025/05/01 05:30 20m retest repro upstream no crash log
2025/05/01 04:50 19m retest repro upstream no crash log
2025/05/01 04:50 19m retest repro upstream no crash log
2025/02/20 03:55 24m retest repro upstream report log
2025/02/20 03:55 23m retest repro upstream report log
2025/02/20 03:55 25m retest repro upstream report log
2025/02/20 03:55 25m retest repro upstream report log

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in lib/xarray.c:147:16
shift exponent 128 is too large for 64-bit type 'unsigned long'
CPU: 0 UID: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.14.0-rc1-syzkaller-00034-g92514ef226f5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: loop0 loop_rootcg_workfn
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 get_offset lib/xarray.c:147 [inline]
 xas_descend lib/xarray.c:207 [inline]
 xas_load+0x583/0x5c0 lib/xarray.c:246
 filemap_get_entry+0x1f0/0x3b0 mm/filemap.c:1860
 shmem_get_folio_gfp+0x285/0x1840 mm/shmem.c:2446
 shmem_get_folio mm/shmem.c:2628 [inline]
 shmem_write_begin+0x165/0x350 mm/shmem.c:3278
 generic_perform_write+0x346/0x990 mm/filemap.c:4189
 shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
 do_iter_readv_writev+0x71a/0x9d0
 vfs_iter_write+0x23e/0x600 fs/read_write.c:974
 lo_write_bvec drivers/block/loop.c:245 [inline]
 lo_write_simple drivers/block/loop.c:266 [inline]
 do_req_filebacked drivers/block/loop.c:520 [inline]
 loop_handle_cmd drivers/block/loop.c:1929 [inline]
 loop_process_work+0x1429/0x21c0 drivers/block/loop.c:1964
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/06 03:33 upstream 92514ef226f5 577d049b .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
2025/02/02 22:59 upstream 69e858e0b8b2 568559e4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
2025/02/01 09:07 upstream 69e858e0b8b2 aa47157c .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
2025/02/01 08:50 upstream 69e858e0b8b2 aa47157c .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
2025/01/31 18:03 upstream 69e858e0b8b2 aa47157c .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
2025/01/29 17:52 upstream 805ba04cb7cc d03b0c97 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in filemap_get_entry
* Struck through repros no longer work on HEAD.