UBSAN: shift-out-of-bounds in null_process_zoned_cmd

Status: upstream: reported on 2026/08/04 19:02
Reported-by: syzbot+92f93c65f133d6ac44b2@syzkaller.appspotmail.com
First crash: 7d19h, last: 1d15h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: shift-out-of-bounds in null_process_zoned_cmd block prio:low -1 15 10h54m 5d22h 0/29 upstream: reported on 2026/08/06 15:37

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in drivers/block/null_blk/zoned.c:16:14
shift exponent -1 is negative
CPU: 0 PID: 150 Comm: kworker/0:1H Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: kblockd blk_mq_run_work_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 lib/ubsan.c:321
 null_zone_no drivers/block/null_blk/zoned.c:16 [inline]
 null_process_zoned_cmd+0xf2f/0x1220 drivers/block/null_blk/zoned.c:684
 null_handle_cmd+0x362/0x990 drivers/block/null_blk/main.c:1374
 blk_mq_dispatch_rq_list+0xa06/0x1c50 block/blk-mq.c:1387
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:200 [inline]
 blk_mq_do_dispatch_sched+0xadf/0xc90 block/blk-mq-sched.c:214
 __blk_mq_sched_dispatch_requests+0x32c/0x410 block/blk-mq-sched.c:-1
 blk_mq_sched_dispatch_requests+0xf4/0x1b0 block/blk-mq-sched.c:366
 __blk_mq_run_hw_queue+0xbb/0x100 block/blk-mq.c:1512
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
================================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/10 23:00 linux-5.15.y aabd761612db 508909ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in null_process_zoned_cmd
2026/08/04 19:02 linux-5.15.y 6e2fd6534337 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in null_process_zoned_cmd
2026/08/04 19:01 linux-5.15.y 6e2fd6534337 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan UBSAN: shift-out-of-bounds in null_process_zoned_cmd
* Struck through repros no longer work on HEAD.