syzbot
UBSAN: shift-out-of-bounds in squashfs_xz_comp_opts
Status:
upstream: reported C repro on 2026/02/17 19:48
Subsystems:
squashfs
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+99fc070a2affcd27784b@syzkaller.appspotmail.com
Fix commit:
Squashfs: check xz dictionary size isn't zero
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 256d, last: 217d
Sample crash report:
* Struck through repros no longer work on HEAD.