[BUG] UBSAN: shift-out-of-bounds in dm_integrity_map

[BUG] UBSAN: shift-out-of-bounds in dm_integrity_map

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/193-ubsan-shift-out-of-bounds-in-dm-integrity-map/

  UBSAN: shift-out-of-bounds in drivers/md/dm-integrity.c:2106:52
  shift exponent 138 is too large for 32-bit type 'unsigned int'
  Call Trace:
   dm_integrity_map+0xe14/0xfe0 drivers/md/dm-integrity.c:2106
   __map_bio+0x5e8/0xa60 drivers/md/dm.c:1426
   __split_and_process_bio drivers/md/dm.c:1760 [inline]
   dm_split_and_process_bio drivers/md/dm.c:2034 [inline]
   dm_submit_bio+0x73f/0x2900 drivers/md/dm.c:2090
   __submit_bio+0x475/0x880 block/blk-core.c:644
   submit_bio_noacct_nocheck+0x467/0x990 block/blk-core.c:755
   __block_write_full_folio+0x7ee/0xdc0 fs/buffer.c:1830
   blkdev_writepages+0xef/0x1b0 block/fops.c:486
  Kernel panic - not syncing: UBSAN: panic_on_warn set ...

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] UBSAN: shift-out-of-bounds in dm_integrity_map

[Greg KH]

On Thu, Aug 27, 2026 at 10:51:35PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/193-ubsan-shift-out-of-bounds-in-dm-integrity-map/
> 
>   UBSAN: shift-out-of-bounds in drivers/md/dm-integrity.c:2106:52
>   shift exponent 138 is too large for 32-bit type 'unsigned int'
>   Call Trace:
>    dm_integrity_map+0xe14/0xfe0 drivers/md/dm-integrity.c:2106
>    __map_bio+0x5e8/0xa60 drivers/md/dm.c:1426
>    __split_and_process_bio drivers/md/dm.c:1760 [inline]
>    dm_split_and_process_bio drivers/md/dm.c:2034 [inline]
>    dm_submit_bio+0x73f/0x2900 drivers/md/dm.c:2090
>    __submit_bio+0x475/0x880 block/blk-core.c:644
>    submit_bio_noacct_nocheck+0x467/0x990 block/blk-core.c:755
>    __block_write_full_folio+0x7ee/0xdc0 fs/buffer.c:1830
>    blkdev_writepages+0xef/0x1b0 block/fops.c:486
>   Kernel panic - not syncing: UBSAN: panic_on_warn set ...
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

You seem to have sent 59 emails like this in a day....

Please slow down, learn the proper process here, before flooding
different substems with random reports like this that are not helpful at
all.

greg k-h