KASAN: slab-out-of-bounds Read in dbAllocBits

Status: upstream: reported C repro on 2024/05/09 13:18
Subsystems: jfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+0be47376a6acbcba7f0d@syzkaller.appspotmail.com
First crash: 918d, last: 9h38m
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
✨ AI-generated root cause summary:

In JFS block allocation, dbAllocNear() (and dbAllocDmapLev()) in fs/jfs/jfs_dmap.c calculates the block number blkno using the untrusted on-disk field dp->start without validating it against the filesystem geometry or map size. When passing this blkno to dbAllocDmap() -> dbAllocBits(), the allocation group index is calculated as agno = blkno >> bmp->db_agl2size. Because neither dp->start nor agno is validated against MAXAG (128), a corrupted dmap page allows agno to exceed MAXAG, causing an out-of-bounds slab read and write on bmp->db_agfree[agno].

▶ ▼ ✨ Full AI root cause analysis
Based on kernel commit 7367539ad4b0:

Technical Root Cause Analysis

1. Relevant Subsystems and Files

  • File: fs/jfs/jfs_dmap.c
  • Functions: dbAlloc(), dbAllocNear(), dbAllocDmapLev(), dbAllocDmap(), dbAllocBits()
  • Structures & Fields:
    • struct dmap (dp->start): On-disk dmap descriptor read from disk pages.
    • struct bmap (bmp->db_bmap.dn_agfree[], alias bmp->db_agfree): In-memory block allocation map descriptor of size ~1768 bytes, allocated from the kmalloc-2k slab cache in dbMount().
    • MAXAG (128): Maximum number of allocation groups supported; determines the array bounds of bmp->db_agfree[MAXAG].

2. Trigger and Mechanism

  1. Initial Hint & Metapage Read: When an extended attribute operation allocates disk blocks (e.g. via ea_get() calling dbAlloc()), dbAlloc() takes an allocation hint and validates that blkno = hint + 1 < bmp->db_mapsize. It computes the logical block number lblkno = BLKTODMAP(blkno, bmp->db_l2nbperpage) and reads the corresponding dmap page from disk via read_metapage() into dp = (struct dmap *)mp->data.

  2. Unvalidated dp->start Calculation: If the fast path dbAllocNext() cannot satisfy the request, dbAlloc() falls back to dbAllocNear(bmp, dp, blkno, ...). In dbAllocNear(), instead of using the caller's validated blkno, the code recomputes blkno starting from the on-disk value dp->start:

    blkno = le64_to_cpu(dp->start) + (word << L2DBWORD);

    (A matching pattern exists in dbAllocDmapLev(): blkno = le64_to_cpu(dp->start) + (leafidx << L2DBWORD);). Crucially, dp->start is an untrusted field stored directly on disk and is never validated against the logical block offset of the metapage, nor is blkno bounds-checked against bmp->db_mapsize.

  3. Out-of-Bounds Allocation Group Index (agno): dbAllocNear() passes this corrupted blkno to dbAllocDmap(), which calls dbAllocBits(bmp, dp, blkno, nblocks). In dbAllocBits():

    agno = blkno >> bmp->db_agl2size;
if (agno > bmp->db_maxag)
    bmp->db_maxag = agno;

/* update the free count for the allocation group and map */
bmp->db_agfree[agno] -= nblocks;
bmp->db_nfree -= nblocks;

    Because dp->start is unverified, blkno >> bmp->db_agl2size yields an agno >= MAXAG (in this report, agno = 464).

  4. Slab Out-of-Bounds Access: The bmp->db_agfree array has only MAXAG (128) 64-bit entries, beginning at offset 56 (0x38) of struct bmap. An access with agno = 464 accesses offset 56 + 464 * 8 = 3768 (0xeb8) relative to the base of struct bmap. Since struct bmap is allocated from kmalloc-2k (2048 bytes), this offset lies 1720 bytes past the end of the allocated object, triggering the KASAN slab out-of-bounds read report on bmp->db_agfree[agno] -= nblocks; (and subsequently corrupting memory via the decrement write).

▶ ▼ ✨ AI Jobs (10)
ID Workflow Result Correct Bug Created Started Finished Revision
932b991b assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: slab-out-of-bounds Read in dbAllocBits 2026/11/09 01:50 2026/11/09 01:50 2026/11/09 02:20 5cecaf1f
1ca269c0 assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/10/09 02:17 2026/10/09 02:17 2026/10/09 02:48 723be09b
ccb280c9 assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/09/09 01:57 2026/09/09 01:57 2026/09/09 02:19 243b72f1
62fdd3f7 assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/08/09 17:38 2026/08/09 17:38 2026/08/09 18:02 5d63f80b
a28575e8 assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/07/08 01:31 2026/07/08 01:31 2026/07/08 01:54 93f57954
be83199a assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/06/22 01:21 2026/06/22 01:21 2026/06/22 01:55 43bfcdb0
04fcaf6f assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/06/14 01:12 2026/06/14 01:12 2026/06/14 01:39 4f06757f
27d9f56a assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/06/09 16:23 2026/06/09 16:23 2026/06/09 16:48 c36c07f6
af65c117 assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/06/02 11:03 2026/06/02 11:03 2026/06/02 11:33 1095583b
f3b74e1b assessment-security 💥 KASAN: slab-out-of-bounds Read in dbAllocBits 2026/05/24 08:16 2026/05/24 08:16 2026/05/24 08:37 c69befb3
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH v3] jfs: fix slab-out-of-bounds in dbAllocBits and dbFreeBits 2 (2) 2026/05/14 15:50
[PATCH v2] jfs: fix slab-out-of-bounds in dbAllocBits and dbFreeBits 1 (1) 2026/03/22 13:38
[syzbot] [jfs?] KASAN: slab-out-of-bounds Read in dbAllocBits 1 (6) 2026/03/22 13:32
[PATCH] jfs: fix slab-out-of-bounds read in dbAllocBits 1 (1) 2026/03/21 13:29
Re: KASAN: slab-out-of-bounds Read in dbAllocBits 1 (1) 2025/05/21 12:18
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in dbAllocBits jfs 19 syz, C inconclusive error 234 1046d 1497d 0/29 auto-obsoleted due to no activity on 2024/03/07 21:48
linux-4.19 KASAN: use-after-free Read in dbAllocBits 19 syz, C error 2 1478d 1500d 0/1 upstream: reported C repro on 2022/10/01 12:57
linux-5.15 UBSAN: array-index-out-of-bounds in dbAllocBits origin:upstream 15 syz, C error 5 32d 1270d 0/3 upstream: reported C repro on 2023/05/19 07:30
linux-6.6 UBSAN: array-index-out-of-bounds in dbAllocBits origin:upstream 15 syz, C error 1 246d 246d 0/2 upstream: reported C repro on 2026/03/08 09:25
linux-6.1 UBSAN: array-index-out-of-bounds in dbAllocBits origin:upstream 15 syz, C error 4 302d 1270d 0/3 upstream: reported C repro on 2023/05/19 04:28
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2026/11/09 07:11 15m retest repro upstream report job log log
2026/10/25 18:39 22m retest repro upstream report job log log
2026/10/11 16:51 16m retest repro upstream job log log
2026/10/11 16:51 17m retest repro upstream report job log log
2026/04/22 15:29 25m retest repro upstream error
2026/04/22 15:50 21m retest repro upstream report log
2026/04/22 15:29 25m retest repro upstream log
2026/03/22 13:32 17m junyeonggim5@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7367539ad4b0f8f9b396baf02110962333719a48 OK log
2026/03/22 13:12 17m junyeonggim5@gmail.com patch upstream log
2026/03/22 12:51 17m junyeonggim5@gmail.com patch upstream log
2026/02/18 11:28 17m retest repro upstream error
2026/02/18 11:28 15m retest repro upstream error
2026/01/30 09:02 15m retest repro upstream report log
2025/11/25 19:28 19m activprithvi@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7367539ad4b0f8f9b396baf02110962333719a48 OK log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in dbAllocBits+0x61e/0x630 fs/jfs/jfs_dmap.c:2255
Read of size 8 at addr ffff88802639eeb8 by task syz-executor242/5196

CPU: 2 PID: 5196 Comm: syz-executor242 Not tainted 6.9.0-rc6-syzkaller-00234-g7367539ad4b0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 dbAllocBits+0x61e/0x630 fs/jfs/jfs_dmap.c:2255
 dbAllocDmap+0x5c/0x110 fs/jfs/jfs_dmap.c:2032
 dbAllocNear fs/jfs/jfs_dmap.c:1258 [inline]
 dbAlloc+0x784/0xab0 fs/jfs/jfs_dmap.c:843
 ea_get+0xc11/0x12c0 fs/jfs/xattr.c:514
 __jfs_setxattr+0x1ed/0x1070 fs/jfs/xattr.c:718
 __jfs_set_acl+0x110/0x1a0 fs/jfs/acl.c:87
 jfs_set_acl+0x256/0x330 fs/jfs/acl.c:115
 set_posix_acl+0x25c/0x320 fs/posix_acl.c:955
 vfs_set_acl+0x53d/0x900 fs/posix_acl.c:1134
 do_set_acl+0xd9/0x1b0 fs/posix_acl.c:1279
 do_setxattr+0xeb/0x170 fs/xattr.c:626
 setxattr+0x15d/0x180 fs/xattr.c:652
 path_setxattr+0x179/0x1e0 fs/xattr.c:671
 __do_sys_lsetxattr fs/xattr.c:694 [inline]
 __se_sys_lsetxattr fs/xattr.c:690 [inline]
 __x64_sys_lsetxattr+0xc1/0x160 fs/xattr.c:690
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f03a87c66b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffca6e6e748 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f03a87c66b9
RDX: 0000000020000180 RSI: 0000000020000040 RDI: 0000000020000000
RBP: 00007f03a883f610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffca6e6e918 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Allocated by task 4906:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3966 [inline]
 __kmalloc_node_track_caller+0x220/0x470 mm/slub.c:3986
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:599
 __alloc_skb+0x164/0x380 net/core/skbuff.c:668
 __netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:732
 __netdev_alloc_skb_ip_align include/linux/skbuff.h:3321 [inline]
 e1000_alloc_rx_buffers+0x3b5/0x7b0 drivers/net/ethernet/intel/e1000e/netdev.c:668
 e1000_configure+0x199a/0x4ad0 drivers/net/ethernet/intel/e1000e/netdev.c:3761
 e1000e_open+0x403/0x1790 drivers/net/ethernet/intel/e1000e/netdev.c:4658
 __dev_open+0x2d4/0x4e0 net/core/dev.c:1430
 __dev_change_flags+0x561/0x720 net/core/dev.c:8692
 dev_change_flags+0x8f/0x160 net/core/dev.c:8764
 devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1172
 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1001
 sock_do_ioctl+0x116/0x280 net/socket.c:1222
 sock_ioctl+0x22e/0x6c0 net/socket.c:1341
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl fs/ioctl.c:890 [inline]
 __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:890
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802639e000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1720 bytes to the right of
 allocated 2048-byte region [ffff88802639e000, ffff88802639e800)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26398
head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888015042f00 ffffea000069fc00 dead000000000002
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
head: 00fff00000000840 ffff888015042f00 ffffea000069fc00 dead000000000002
head: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
head: 00fff00000000003 ffffea000098e601 dead000000000122 00000000ffffffff
head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4675, tgid -996255200 (klogd), ts 4675, free_ts 20473074610
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
 __alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2175 [inline]
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2391
 ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 kmalloc_trace+0x2fb/0x330 mm/slub.c:3992
 kmalloc include/linux/slab.h:628 [inline]
 syslog_print+0xf9/0x5d0 kernel/printk/printk.c:1556
 do_syslog+0x3be/0x6a0 kernel/printk/printk.c:1734
 __do_sys_syslog kernel/printk/printk.c:1826 [inline]
 __se_sys_syslog kernel/printk/printk.c:1824 [inline]
 __x64_sys_syslog+0x74/0xb0 kernel/printk/printk.c:1824
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 4675 tgid 4675 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
 __put_partials+0x14c/0x170 mm/slub.c:2906
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3798 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
 alloc_skb include/linux/skbuff.h:1313 [inline]
 alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6515
 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2795
 unix_dgram_sendmsg+0x4b9/0x1b10 net/unix/af_unix.c:2019
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x47f/0x4e0 net/socket.c:2191
 __do_sys_sendto net/socket.c:2203 [inline]
 __se_sys_sendto net/socket.c:2199 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802639ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802639ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802639ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                        ^
 ffff88802639ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802639ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (315):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/05 13:06 upstream 7367539ad4b0 610f2a54 .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-qemu-upstream KASAN: slab-out-of-bounds Read in dbAllocBits
2025/10/31 12:00 upstream d127176862a9 2c50b6a9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2025/07/21 14:43 upstream 89be9a83ccf1 56d87229 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/10/26 06:33 upstream 21a7f44fd076 1d9ca40b .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/31 08:51 upstream d127176862a9 2c50b6a9 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2024/08/18 15:11 upstream c3f2d783a459 e1c76ab2 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/25 08:27 upstream 165768bb7026 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/07 17:57 upstream df2908090cda 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/01 15:07 upstream 786262be6048 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/05 12:39 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/07/25 10:14 upstream e2a936998ab2 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/04/26 17:58 upstream 897d54018cc9 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/04/08 15:29 upstream 3036cd0d3328 d9b7f621 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2026/02/04 10:05 upstream de0674d9bc69 42b01fab .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dbAllocBits
2024/06/20 11:08 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/10/26 04:30 upstream 21a7f44fd076 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/27 16:42 upstream fd179f8a05be a3c7249d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/26 11:33 upstream f14572c203d5 a3c7249d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/13 21:18 upstream d681d7ef617e 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/13 14:24 upstream 2f0c1cf72f46 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/09/10 01:41 upstream 893e11787f78 4e8b1cc6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/31 21:01 upstream cee9395acd80 00e9c810 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/25 07:22 upstream 818bebeb63dd 614e416a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/19 08:37 upstream b126f6f5940f 1e72964b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/11 02:00 upstream d58772d8520c 508909ea .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/07 19:57 upstream f9a2394a2348 e4ef95d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/08/01 04:14 upstream a2cf4ef33184 e611ffe1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/07/28 03:12 upstream 62cc90241548 45ae1df4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/07/19 06:07 upstream f2ec6312bf71 72524a66 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/07/16 00:42 upstream 58717b2a1365 27a8bd60 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/07/10 06:50 upstream a635d6748234 4167ee25 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/30 05:39 upstream dc59e4fea9d8 fff8d0a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/27 01:54 upstream 51cb1aa1250c fb92f11c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/23 06:52 upstream 4708cac0e22c 5a630be6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/14 09:13 upstream 2b07ea76fd28 4f06757f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/13 04:39 upstream 1dadb7e7eb5a 4f06757f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/06/02 21:57 upstream 6f3ed7fec72f 62fe1528 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/05/30 04:18 upstream 9215e74f228f 6b4a8443 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/05/26 19:38 upstream d60ec36cab33 2b0043b4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/05/12 17:24 upstream 50897c955902 07aeade5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/03/28 17:56 upstream be762d8b6dd7 b5ceaad2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/03/22 15:36 upstream 113ae7b4decc 5b92003d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/03/16 18:57 upstream f338e7738378 64e21424 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/01/16 08:57 upstream 54e82e93ca93 d1b870e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2026/01/08 20:56 upstream 54e82e93ca93 d1b870e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/12/25 13:07 upstream ccd1cdca5cd4 d1b870e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/12/21 06:39 upstream d8ba32c5a460 d1b870e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/11/30 13:18 upstream 6bda50f4333f d1b870e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/11/01 23:36 upstream 691d401c7e0e 2c50b6a9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/31 08:00 upstream d127176862a9 2c50b6a9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/27 21:12 upstream dcb6fa37fd7b fd2207e7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/12 08:41 upstream 98906f9d850e ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/06 16:21 upstream fd94619c4336 91305dbe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/10/04 22:54 linux-next 47a8d4b89844 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dbAllocBits
2025/12/11 22:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 05c93f3395ed d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in dbAllocBits
* Struck through repros no longer work on HEAD.