UBSAN: array-index-out-of-bounds in dtInsertEntry

Status: upstream: reported C repro on 2024/10/03 19:10
Subsystems: jfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
First crash: 734d, last: 1d09h
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: BUG: Bad page state (log)
Repro: C syz .config
  
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
7e901def assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ UBSAN: array-index-out-of-bounds in dtInsertEntry 2026/05/31 15:45 2026/05/31 15:45 2026/05/31 16:29 6b4a8443
a4778db4 assessment-security 💥 UBSAN: array-index-out-of-bounds in dtInsertEntry 2026/05/15 05:24 2026/05/15 05:24 2026/05/15 05:25 6ccb967e
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[syzbot] Monthly jfs report (Sep 2026) 0 (1) 2026/09/01 20:33
[syzbot] Monthly jfs report (Aug 2026) 0 (1) 2026/08/02 00:00
[syzbot] Monthly jfs report (Jul 2026) 0 (1) 2026/07/01 12:32
[syzbot] Monthly jfs report (Mar 2026) 0 (1) 2026/03/31 08:07
[syzbot] Monthly jfs report (Dec 2025) 0 (1) 2025/12/26 07:48
[PATCH] jfs: fix array-index-out-of-bounds in linelock by using flexible array for lv 1 (1) 2025/11/20 15:43
[syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtInsertEntry 0 (3) 2025/11/18 14:11
[PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry 4 (4) 2024/10/31 01:58
UBSAN: array-index-out-of-bounds in dtInsertEntry 1 (2) 2024/10/10 13:43
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 BUG: unable to handle kernel paging request in dtInsertEntry missing-backport origin:upstream 19 syz, C error 498 101d 1214d 0/3 upstream: reported C repro on 2023/06/07 09:20
linux-6.6 KASAN: slab-out-of-bounds Read in dtInsertEntry origin:upstream missing-backport 17 syz, C error 132 123d 455d 0/2 upstream: reported C repro on 2025/07/05 15:47
linux-6.1 BUG: unable to handle kernel paging request in dtInsertEntry 15 syz, C error 17 769d 1214d 0/3 auto-obsoleted due to no activity on 2024/12/03 11:36
upstream general protection fault in dtInsertEntry jfs 17 syz, C inconclusive 501 782d 907d 27/29 fixed on 2024/08/14 03:44
upstream BUG: unable to handle kernel NULL pointer dereference in dtInsertEntry jfs 19 syz, C error done 29 974d 1468d 25/29 fixed on 2024/03/20 11:33
linux-6.1 KASAN: slab-out-of-bounds Read in dtInsertEntry origin:upstream missing-backport 21 syz, C inconclusive 221 55d 543d 0/3 upstream: reported C repro on 2025/04/08 17:54
linux-4.19 general protection fault in dtInsertEntry 19 syz, C error 4 1422d 1468d 0/1 upstream: reported C repro on 2022/09/26 01:50
linux-4.14 general protection fault in dtInsertEntry 2 syz, C 3 1312d 1469d 0/1 upstream: reported C repro on 2022/09/25 23:44
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/07/21 21:26 1h47m retest repro upstream log
2026/07/21 21:26 1h38m retest repro upstream log
2026/07/21 21:26 19m retest repro upstream log
2026/07/21 21:26 20m retest repro upstream log
2026/07/21 21:26 21m retest repro upstream log
2026/07/20 02:44 18m retest repro upstream log
2026/07/20 02:44 18m retest repro upstream log
2026/07/20 02:44 19m retest repro upstream log
2026/07/20 02:44 19m retest repro upstream log
2026/07/20 02:44 19m retest repro upstream log
2025/11/18 14:11 19m yun.zhou@windriver.com patch upstream report log
2024/10/10 13:14 19m ghanshyam1898@gmail.com patch upstream OK log

Sample crash report:
loop0: detected capacity change from 0 to 32768
 ... Log Wrap ... Log Wrap ... Log Wrap ...
read_mapping_page failed!
ERROR: (device loop0): txCommit: 
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:3700:8
index -1 is out of range for type 'struct dtslot[128]'
CPU: 1 UID: 0 PID: 6074 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:455
 dtInsertEntry+0x936/0x1430 fs/jfs/jfs_dtree.c:3700
 dtSplitPage+0x290b/0x37c0 fs/jfs/jfs_dtree.c:1596
 dtSplitUp fs/jfs/jfs_dtree.c:1092 [inline]
 dtInsert+0x107a/0x5de0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x783/0xb00 fs/jfs/namei.c:270
 vfs_mkdir+0x52c/0x5d0 fs/namei.c:5139
 do_mkdirat+0x281/0x4c0 fs/namei.c:5173
 __do_sys_mkdirat fs/namei.c:5195 [inline]
 __se_sys_mkdirat fs/namei.c:5193 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:5193
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7febb3dd9b97
Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff3a6059f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fff3a605a80 RCX: 00007febb3dd9b97
RDX: 00000000000001ff RSI: 0000200000000540 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000540
R13: 00007fff3a605a40 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
---[ end trace ]---

Crashes (3313):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/19 05:00 upstream e84d960149e7 20d37d28 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/12/27 19:25 upstream c53f467229a7 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/12/02 18:40 upstream 4a26e7032d7d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/04/30 14:58 upstream b6ea1680d0ac 85a5a23f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/04/30 13:24 upstream b6ea1680d0ac 85a5a23f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/04/30 12:06 upstream b6ea1680d0ac 85a5a23f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/04/30 10:58 upstream b6ea1680d0ac 85a5a23f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2024/10/10 11:56 upstream d3d1556696c1 0278d004 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2025/08/24 11:23 upstream 8d245acc1e88 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-out-of-bounds Read in dtInsertEntry
2025/07/26 02:07 upstream 2942242dde89 fb8f743d .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-out-of-bounds Read in dtInsertEntry
2025/07/06 12:34 upstream 1f988d0788f5 4f67c4ae .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-out-of-bounds Read in dtInsertEntry
2025/06/26 00:48 upstream 92ca6c498a5e 26d77996 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-out-of-bounds Read in dtInsertEntry
2025/05/15 14:21 upstream c94d59a126cb d6b2ee52 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-out-of-bounds Read in dtInsertEntry
2026/09/14 14:54 upstream 704340f1cd0d 924033e8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/01 20:28 upstream 786262be6048 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/30 23:07 upstream a23cbb05744b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/30 20:20 upstream a23cbb05744b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/27 18:11 upstream 73e3f0710014 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/13 04:59 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/11 02:21 upstream d58772d8520c 508909ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/25 22:09 upstream e7ae89a0c97c c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2024/09/29 19:01 upstream e7ed34365879 ba29ff75 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/10/02 16:06 upstream ce1e0223d8ad 1065c8fa .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/10/02 05:06 upstream d24e8ac715de 6d32eb1f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/10/02 00:02 upstream d24e8ac715de 6d32eb1f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/10/01 14:00 upstream 551c722f4080 38f7f0d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/30 21:41 upstream 551c722f4080 4db88980 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/29 08:23 upstream 72d3fcf802c4 7bf4ea23 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/28 05:49 upstream d266640c6c76 a3c7249d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/25 03:52 upstream 5fc5768c7ca9 27d05fb3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/22 03:49 upstream f0100363d8c3 a8efa948 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/20 12:08 upstream 518e5b794c06 853b104b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/19 05:41 upstream 40288c9206c1 853b104b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/16 17:18 upstream 9b87fdc9af2f b0e4c57e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/16 16:11 upstream 9b87fdc9af2f b0e4c57e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/12 20:23 upstream 5225b8eec4c9 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/12 04:46 upstream 827751b699b7 70a60e12 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/05 07:25 upstream 654ae5d73c05 4f7b22a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/28 03:08 upstream 818bebeb63dd e2fa417d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/27 15:14 upstream 818bebeb63dd c53a1b9c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/22 02:59 upstream 818bebeb63dd 1e72964b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/15 20:30 upstream 15ef2f78c49d 746171ee .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/14 07:51 upstream 3aa1dcaa4f6f b13552fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/08 21:01 upstream a59f57e2aa12 5d63f80b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/08/05 20:58 upstream c21bb4193868 1eed00d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/07/22 07:38 upstream 248951ddc14d b561ce9c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/07/04 10:08 upstream 71dfdfb0209b fcece630 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/07/02 13:16 upstream 4a50a141f05a 27192279 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/06/20 07:13 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/06/03 13:40 upstream ba3e43a9e601 234057e5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/06/01 00:45 upstream 8d9c51eac648 6b4a8443 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/30 07:34 upstream 9215e74f228f 6b4a8443 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/29 05:38 upstream 8fde5d1d47f6 4624854e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/24 16:18 upstream 4cbfe4502e3d c69befb3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/21 16:38 upstream 8bc67e4db64a 747d777d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/20 01:30 upstream 27fa82620cba 6cd1a940 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/05/18 01:03 upstream e5d505e3664b de5aae85 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/23 22:41 linux-next a8c591ed6b67 0a1606bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/11 15:45 linux-next a9d7ced84989 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/08 21:11 linux-next 9d80aa4617b3 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/08 08:05 linux-next 9d80aa4617b3 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/09/07 09:09 linux-next 9d80aa4617b3 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/02/06 08:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 f03c4191 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in dtInsertEntry
2026/02/20 14:27 upstream 8bf22c33e7a1 17d780d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in dtInsertEntry
* Struck through repros no longer work on HEAD.