From: syzbot <syzbot+7edb85bc97be9f350d90@syzkaller.appspotmail.com>
To: jfs-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, shaggy@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] UBSAN: shift-out-of-bounds in dbFindCtl
Date: Mon, 10 Oct 2022 17:00:40 -0700 [thread overview]
Message-ID: <0000000000007482b905eab6f749@google.com> (raw)
In-Reply-To: <00000000000093079705ea9aada2@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 4899a36f91a9 Merge tag 'powerpc-6.1-1' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12ead462880000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2021a61197ebe02
dashboard link: https://syzkaller.appspot.com/bug?extid=7edb85bc97be9f350d90
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1404403a880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10789852880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1a98722ff83f/disk-4899a36f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7a31d6690395/vmlinux-4899a36f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6fb347a504fa/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7edb85bc97be9f350d90@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1671:12
shift exponent 1834973817 is too large for 64-bit type 'long long int'
CPU: 0 PID: 3603 Comm: syz-executor644 Not tainted 6.0.0-syzkaller-09413-g4899a36f91a9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
ubsan_epilogue+0xb/0x50 lib/ubsan.c:151
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x187 lib/ubsan.c:322
dbFindCtl.cold+0x52/0x57 fs/jfs/jfs_dmap.c:1671
dbAllocAny+0xa4/0x1a0 fs/jfs/jfs_dmap.c:1502
dbAlloc+0x46d/0xa70 fs/jfs/jfs_dmap.c:859
diNewExt+0x724/0x1a10 fs/jfs/jfs_imap.c:2251
diAllocExt fs/jfs/jfs_imap.c:1945 [inline]
diAllocAG+0x15f1/0x2200 fs/jfs/jfs_imap.c:1662
diAlloc+0x82d/0x1730 fs/jfs/jfs_imap.c:1583
ialloc+0x89/0xaa0 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1f0/0xab0 fs/jfs/namei.c:225
vfs_mkdir+0x489/0x740 fs/namei.c:4013
do_mkdirat+0x28c/0x310 fs/namei.c:4038
__do_sys_mkdir fs/namei.c:4058 [inline]
__se_sys_mkdir fs/namei.c:4056 [inline]
__x64_sys_mkdir+0xf2/0x140 fs/namei.c:4056
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc402fc5c29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc056f56d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc402fc5c29
RDX: 00007fc402f84123 RSI: 0000000000000000 RDI: 00000000200052c0
RBP: 00007fc402f853f0 R08: 0000555555d8a2c0 R09: 0000000000000000
R10: 00007ffc056f55a0 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 00080000000000f4 R15: 0000000000000000
</TASK>
================================================================================
next prev parent reply other threads:[~2022-10-11 0:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-09 14:15 [syzbot] UBSAN: shift-out-of-bounds in dbFindCtl syzbot
2022-10-11 0:00 ` syzbot [this message]
2023-03-30 19:45 ` [syzbot] [jfs?] " syzbot
2023-03-31 8:43 ` Aleksandr Nogikh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000007482b905eab6f749@google.com \
--to=syzbot+7edb85bc97be9f350d90@syzkaller.appspotmail.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=shaggy@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.