UBSAN: shift-out-of-bounds in dbFree

Date	Name	Commit	Repro	Result
2023/05/04	upstream (ToT)	1a5304fecee5	C	[report] UBSAN: shift-out-of-bounds in dbFree
2023/08/03	upstream (ToT)	ec351c8f2e62	C	Didn't crash

Date

Name

Commit

Repro

Result

2023/05/04

upstream (ToT)

1a5304fecee5

[report] UBSAN: shift-out-of-bounds in dbFree

2023/08/03

upstream (ToT)

ec351c8f2e62

Didn't crash

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	UBSAN: shift-out-of-bounds in dbFree jfs	-1	syz, C	error		3	1163d	1229d	23/29	fixed on 2023/10/12 12:47
linux-5.15	UBSAN: shift-out-of-bounds in dbFree origin:upstream	-1	syz, C		done	1	1126d	1188d	3/3	fixed on 2023/09/19 11:28

Rank 🛈

upstream

UBSAN: shift-out-of-bounds in dbFree jfs

-1

syz, C

error

1163d

1229d

23/29

fixed on 2023/10/12 12:47

linux-5.15

UBSAN: shift-out-of-bounds in dbFree origin:upstream

-1

syz, C

done

1126d

1188d

3/3

fixed on 2023/09/19 11:28


Created	Duration	User	Repo	Result
2023/09/19 13:52	3h06m	bisect fix	linux-6.1.y	OK (1) job log
2023/07/05 08:42	1h20m	bisect fix	linux-6.1.y	OK (0) job log log
2023/06/02 00:58	39m	bisect fix	linux-6.1.y	OK (0) job log log

ERROR: (device loop0): txCommit: ERROR: (device loop0): remounting filesystem as read-only ================================================================================ UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:381:12 shift exponent 134217736 is too large for 64-bit type 'long long' CPU: 0 PID: 3540 Comm: syz-executor912 Not tainted 6.1.27-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 lib/ubsan.c:321 dbFree+0x46a/0x650 fs/jfs/jfs_dmap.c:381 txFreeMap+0x966/0xd50 fs/jfs/jfs_txnmgr.c:2510 xtTruncate+0xe58/0x3260 fs/jfs/jfs_xtree.c:2467 jfs_free_zero_link+0x46a/0x6e0 fs/jfs/namei.c:758 jfs_evict_inode+0x35b/0x440 fs/jfs/inode.c:153 evict+0x2a4/0x620 fs/inode.c:664 __dentry_kill+0x436/0x650 fs/dcache.c:607 shrink_dentry_list+0x398/0x6a0 fs/dcache.c:1201 shrink_dcache_parent+0xc9/0x480 do_one_tree+0x23/0xe0 fs/dcache.c:1682 shrink_dcache_for_umount+0x79/0x120 fs/dcache.c:1699 generic_shutdown_super+0x63/0x340 fs/super.c:473 kill_block_super+0x7a/0xe0 fs/super.c:1450 deactivate_locked_super+0xa0/0x110 fs/super.c:332 cleanup_mnt+0x490/0x520 fs/namespace.c:1186 task_work_run+0x246/0x300 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x6fb/0x2300 kernel/exit.c:869 do_group_exit+0x202/0x2b0 kernel/exit.c:1019 __do_sys_exit_group kernel/exit.c:1030 [inline] __se_sys_exit_group kernel/exit.c:1028 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1028 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f544b4c69c9 Code: Unable to access opcode bytes at 0x7f544b4c699f. RSP: 002b:00007ffe6afb1ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f544b541330 RCX: 00007f544b4c69c9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f544b53be40 R10: 00007ffe6afb1dc0 R11: 0000000000000246 R12: 00007f544b541330 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK> ================================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/05/02 06:16	linux-6.1.y	ca48fc16c493	62df2017	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-linux-6-1-kasan	UBSAN: shift-out-of-bounds in dbFree

Crashes (1):

Assets (help?)