UBSAN: array-index-out-of-bounds in dbFindLeaf (2)

Status: upstream: reported C repro on 2026/01/08 13:00
Subsystems: jfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
First crash: 208d, last: 123d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
✨ AI Patch Versions (2)
Version Stage Reported Report Link Job
2 moderation 2026/05/19 21:36 Discussion 6a34b414-433f-4b06-ae87-9e8836b3b11b
1 moderation 2026/05/11 21:05 Discussion 5deba876-6901-4e25-bb74-5f9dc95dd56a
✨ AI Jobs (25)
ID Workflow Result Correct Bug Created Started Finished Revision Error
8e485889 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/05/24 05:07 2026/05/24 05:07 2026/05/24 05:57 c69befb3

			
		
6a34b414 patch-iteration UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/05/19 19:29 2026/05/19 19:29 2026/05/19 21:36 1d9407ad

			
		
094c6390 patch-iteration UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/05/15 09:26 2026/05/15 09:26 2026/05/15 10:32 9cd3beaa

			
		
5deba876 patching-compressed UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/05/11 16:08 2026/05/11 16:08 2026/05/11 21:05 d168f260

			
		
d257e2ea patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/31 21:11 2026/01/31 21:34 2026/01/31 21:41 2186dcab

			
		
2bee216b patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/30 13:36 2026/01/30 14:16 2026/01/30 14:35 22003bbf

			
		
b58a2295 patching-summary UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/30 08:58 2026/01/30 09:33 2026/01/30 09:47 dbc14c8a

			
		
28e004ed patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 17:34 2026/01/29 17:34 2026/01/29 18:23 9f91b6e4

			
		
5ab69b65 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 16:42 2026/01/29 16:42 2026/01/29 16:43 b83e8d3f

			
		
d2f57db3 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 16:18 2026/01/29 16:18 2026/01/29 16:19 b83e8d3f

			
		
0b527a43 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 14:13 2026/01/29 14:13 2026/01/29 14:14 b83e8d3f

			
		
d012ca7d patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 13:54 2026/01/29 14:01 2026/01/29 14:02 b83e8d3f

			
		
ba9b4a31 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 13:20 2026/01/29 13:20 2026/01/29 13:21 b83e8d3f

			
		
ffc11688 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 13:07 2026/01/29 13:07 2026/01/29 13:08 b83e8d3f

			
		
f1ce24ee patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 13:04 2026/01/29 13:04 2026/01/29 13:05 b83e8d3f

			
		
3889a052 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 12:57 2026/01/29 12:57 2026/01/29 12:58 b83e8d3f

			
		
9b49daa0 patching 🏃 UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 12:53 2026/01/29 12:53 43da03a7

			
		
475aa07e patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 12:40 2026/01/29 12:40 2026/01/29 12:51 c7b6e6f2

			
		
5f5cb3a3 patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/29 12:20 2026/01/29 12:20 2026/01/29 12:31 b3e94eff

			
		
9494d58f patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/28 17:25 2026/01/28 17:37 2026/01/28 17:48 8b9a9d26

			
		
fe0b13cb patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/28 17:25 2026/01/28 17:25 2026/01/28 17:37 8b9a9d26

			
		
bdfc643c patching 💥 UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/28 16:41 2026/01/28 16:49 2026/01/28 17:19 a0865364
failed to start /usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/5452af61ab2e1f5601403fe379188fc9d8a831af [/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/5452af61ab2e...
truncated to first 200 bytes; open job for full error
7a3b0fc9 patching 🏃 UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/28 16:29 2026/01/28 16:29 ae74ca81

			
		
3da3a4fb patching UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/27 17:16 2026/01/27 18:44 2026/01/27 19:11 da890efb

			
		
5f1165a4 patching 💥 UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 2026/01/27 17:07 2026/01/27 17:07 2026/01/27 17:07 713ecf46
make failed: failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "128" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/usr/local/google/home/dvyuko...
truncated to first 200 bytes; open job for full error
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) 0 (3) 2026/04/17 16:19
[PATCH] jfs: fix array-index-out-of-bounds in dbFindLeaf 3 (3) 2026/03/02 17:50
[PATCH] jfs: fix oob in dbFindLeaf 1 (1) 2026/01/08 14:45
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in dbFindLeaf jfs 15 syz, C error 6 1055d 1369d 25/29 fixed on 2023/12/21 03:45
linux-6.1 UBSAN: array-index-out-of-bounds in dbFindLeaf 15 1 1129d 1129d 0/3 auto-obsoleted due to no activity on 2023/10/08 15:35
Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/06/16 06:18 22m retest repro upstream log
2026/06/16 06:18 17m retest repro upstream log
2026/06/16 06:18 18m retest repro upstream log
2026/05/07 04:52 20m retest repro upstream report log
2026/04/17 16:19 16m tristmd@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2026/04/17 10:11 14m tristmd@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2026/04/01 13:01 14m retest repro upstream report log
2026/04/01 13:01 51m retest repro upstream report log
2026/04/01 13:01 47m retest repro upstream report log
2026/01/21 10:19 14m retest repro upstream report log
2026/01/21 10:19 16m retest repro upstream report log
2026/01/21 10:19 20m retest repro upstream report log

Sample crash report:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2976:16
index 1365 is out of range for type 's8[1365]' (aka 'signed char[1365]')
CPU: 1 UID: 0 PID: 6059 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455
 dbFindLeaf+0x308/0x520 fs/jfs/jfs_dmap.c:2976
 dbFindCtl+0x267/0x520 fs/jfs/jfs_dmap.c:1717
 dbAllocAny fs/jfs/jfs_dmap.c:1527 [inline]
 dbAlloc+0x5fa/0xba0 fs/jfs/jfs_dmap.c:878
 diNewIAG fs/jfs/jfs_imap.c:2510 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0xd45/0x1df0 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d4/0x1670 fs/jfs/jfs_imap.c:1590
 ialloc+0x8c/0x8f0 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x193/0xa70 fs/jfs/namei.c:225
 vfs_mkdir+0x52d/0x5d0 fs/namei.c:5130
 do_mkdirat+0x27a/0x4b0 fs/namei.c:5164
 __do_sys_mkdirat fs/namei.c:5186 [inline]
 __se_sys_mkdirat fs/namei.c:5184 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:5184
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efe6c5ade97
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efe6bbf4e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007efe6bbf4ef0 RCX: 00007efe6c5ade97
RDX: 00000000000001ff RSI: 00002000000002c0 RDI: 00000000ffffff9c
RBP: 0000200000000200 R08: 00002000000000c0 R09: 0000000000000000
R10: 0000200000000200 R11: 0000000000000246 R12: 00002000000002c0
R13: 00007efe6bbf4eb0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
---[ end trace ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/07 01:47 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbFindLeaf
2026/01/07 00:45 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbFindLeaf
2026/01/06 23:43 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbFindLeaf
2026/01/06 22:59 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbFindLeaf
2026/01/06 22:04 upstream f0b9d8eb98df d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbFindLeaf
* Struck through repros no longer work on HEAD.