From: syzbot <syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt
Date: Sat, 09 Dec 2023 23:36:05 -0800 [thread overview]
Message-ID: <000000000000c2518e060c22de21@google.com> (raw)
In-Reply-To: <tencent_B4064DC995AEF2AEC3CC9E27EE06ED12D706@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in diNewExt
loop0: detected capacity change from 0 to 32768
agno: -878706688, ipimap: ffff88806b342930, iagp: ffff888024d4f000, sbi: ffff888016657a00, agl2s: 13
agno: -878706688, ipimap: ffff88806b342930, iagp: ffff888024d4f000, sbi: ffff888016657a00, agl2s: 13
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2367:2
index -878706688 is out of range for type 'struct iagctl[128]'
CPU: 0 PID: 5481 Comm: syz-executor.0 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
diNewExt+0x3b39/0x3e00 fs/jfs/jfs_imap.c:2367
diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666
diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225
vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106
do_mkdirat+0x264/0x3a0 fs/namei.c:4129
__do_sys_mkdirat fs/namei.c:4144 [inline]
__se_sys_mkdirat fs/namei.c:4142 [inline]
__x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4142
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f857287b5e7
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8571bfdee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f857287b5e7
RDX: 00000000000001ff RSI: 0000000020000140 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000140
R13: 00007f8571bfdf40 R14: 0000000000000000 R15: 0000000000000000
</TASK>
================================================================================
Tested on:
commit: bee0e776 Merge tag 'for-linus-iommufd' of git://git.ke..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=135fd132e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b45dfd882e46ec91
dashboard link: https://syzkaller.appspot.com/bug?extid=553d90297e6d2f50dbc7
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10668e46e80000
next parent reply other threads:[~2023-12-10 7:36 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <tencent_B4064DC995AEF2AEC3CC9E27EE06ED12D706@qq.com>
2023-12-10 7:36 ` syzbot [this message]
[not found] <tencent_5FBE6E042F496EB89494EB7AED4ECD84780A@qq.com>
2023-12-12 1:04 ` [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt syzbot
[not found] <tencent_996A377566D793682361297D63A5244B3705@qq.com>
2023-12-11 12:50 ` syzbot
2023-12-10 6:40 syzbot
2023-12-10 7:24 ` syzbot
2023-12-11 12:30 ` syzbot
2023-12-12 0:30 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c2518e060c22de21@google.com \
--to=syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.