UBSAN: shift-out-of-bounds in dbUpdatePMap

Status: fixed on 2023/09/28 03:03
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+c398d37c5b23e0e0c9ca@syzkaller.appspotmail.com
Fix commit: 11509910c599 jfs: jfs_dmap: Validate db_l2nbperpage while mounting
First crash: 1156d, last: 1115d
Fix bisection: fixed by (bisect log) :
commit c7feb54b113802d2aba98708769d3c33fb017254
Author: Siddh Raman Pant <code@siddh.me>
Date: Tue Jun 20 16:47:00 2023 +0000

  jfs: jfs_dmap: Validate db_l2nbperpage while mounting

  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/06/12 upstream (ToT) 858fd168a95c C [report] UBSAN: shift-out-of-bounds in dbUpdatePMap
2023/07/27 upstream (ToT) 0a8db05b571a C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: shift-out-of-bounds in dbUpdatePMap -1 syz, C error 2 1122d 1156d 0/3 auto-obsoleted due to no activity on 2023/10/24 09:05
upstream UBSAN: shift-out-of-bounds in dbUpdatePMap (2) jfs -1 syz, C error error 4 1098d 1153d 0/29 auto-obsoleted due to no activity on 2023/11/17 21:23
upstream UBSAN: shift-out-of-bounds in dbUpdatePMap jfs -1 syz, C error inconclusive 149 1359d 1410d 0/29 auto-obsoleted due to no activity on 2023/03/01 17:05
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2023/09/27 23:23 3h37m bisect fix linux-6.1.y OK (1) job log
2023/07/23 00:27 3h52m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:470:12
shift exponent 131072 is too large for 64-bit type 'long long'
CPU: 0 PID: 91 Comm: jfsCommit Not tainted 6.1.33-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_shift_out_of_bounds+0x2f4/0x36c lib/ubsan.c:321
 dbUpdatePMap+0xb74/0xcb8 fs/jfs/jfs_dmap.c:470
 txAllocPMap+0x4a4/0x5e0 fs/jfs/jfs_txnmgr.c:2420
 txUpdateMap+0x6e8/0x8e4 fs/jfs/jfs_txnmgr.c:2358
 txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
 jfs_lazycommit+0x3a0/0x988 fs/jfs/jfs_txnmgr.c:2727
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
================================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/12 03:33 linux-6.1.y 2f3918bc53fb 49519f06 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 UBSAN: shift-out-of-bounds in dbUpdatePMap
* Struck through repros no longer work on HEAD.