From: syzbot <syzbot+4f9c823a6f63d87491ba@syzkaller.appspotmail.com>
To: jfs-discussion@lists.sourceforge.net, leo.fthirata@gmail.com,
linux-kernel@vger.kernel.org, shaggy@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtDelete
Date: Tue, 18 Mar 2025 19:43:04 -0700 [thread overview]
Message-ID: <67da2f38.050a0220.3657bb.0135.GAE@google.com> (raw)
In-Reply-To: <CAN-A22rSAtYqRNA_OtFUViY44fjV=sKRbnYHonEJtm2eSN8vyA@mail.gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in jfs_evict_inode
------------[ cut here ]------------
kernel BUG at fs/jfs/inode.c:169!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5776 Comm: syz-executor Not tainted 6.14.0-rc7-syzkaller-g81e4f8d68c66-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:jfs_evict_inode+0x434/0x440 fs/jfs/inode.c:169
Code: df e8 00 e8 d4 fe e9 1d fe ff ff e8 96 a8 6d fe 48 c7 c7 60 42 f5 8e 4c 89 ee e8 77 24 da 01 e9 92 fd ff ff e8 7d a8 6d fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900029ffab8 EFLAGS: 00010293
RAX: ffffffff83543803 RBX: ffff888042646f58 RCX: ffff88801f43c880
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880426472d0
RBP: ffffc900029ffc30 R08: ffffffff825ef183 R09: 1ffffffff28a9b2c
R10: dffffc0000000000 R11: ffffffff83541530 R12: ffff8880426472d0
R13: ffff888042647350 R14: dffffc0000000000 R15: ffff888042642ad0
FS: 00005555647e6500(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555648015c8 CR3: 0000000058ab8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
evict+0x4e8/0x9a0 fs/inode.c:796
dispose_list fs/inode.c:845 [inline]
evict_inodes+0x6f6/0x790 fs/inode.c:899
generic_shutdown_super+0xa0/0x2d0 fs/super.c:627
kill_block_super+0x44/0x90 fs/super.c:1710
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1413
task_work_run+0x24f/0x310 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f885038e497
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffebd08a8a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f885040e08c RCX: 00007f885038e497
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffebd08a960
RBP: 00007ffebd08a960 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffebd08b9f0
R13: 00007f885040e08c R14: 000000000001eab0 R15: 00007ffebd08ba30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_evict_inode+0x434/0x440 fs/jfs/inode.c:169
Code: df e8 00 e8 d4 fe e9 1d fe ff ff e8 96 a8 6d fe 48 c7 c7 60 42 f5 8e 4c 89 ee e8 77 24 da 01 e9 92 fd ff ff e8 7d a8 6d fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900029ffab8 EFLAGS: 00010293
RAX: ffffffff83543803 RBX: ffff888042646f58 RCX: ffff88801f43c880
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880426472d0
RBP: ffffc900029ffc30 R08: ffffffff825ef183 R09: 1ffffffff28a9b2c
R10: dffffc0000000000 R11: ffffffff83541530 R12: ffff8880426472d0
R13: ffff888042647350 R14: dffffc0000000000 R15: ffff888042642ad0
FS: 00005555647e6500(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00987e000 CR3: 0000000058ab8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 81e4f8d6 Merge tag 'pmdomain-v6.14-rc4' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=135c25e4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=27515cfdbafbb90d
dashboard link: https://syzkaller.appspot.com/bug?extid=4f9c823a6f63d87491ba
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=171c644c580000
next prev parent reply other threads:[~2025-03-19 2:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-19 2:26 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtDelete Leonardo Hirata
2025-03-19 2:43 ` syzbot [this message]
[not found] <825ad453-7347-4af7-8a14-3aaf678c83a6n@googlegroups.com>
2025-09-19 15:45 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2025-09-18 21:04 [PATCH] jfs: Add check for array bounds " Pedro Demarchi Gomes
2025-09-18 21:27 ` [syzbot] [jfs?] UBSAN: array-index-out-of-bounds " syzbot
[not found] <20250418032543.128924-1-richard120310@gmail.com>
2025-04-18 3:53 ` syzbot
2025-03-18 19:54 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67da2f38.050a0220.3657bb.0135.GAE@google.com \
--to=syzbot+4f9c823a6f63d87491ba@syzkaller.appspotmail.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=leo.fthirata@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=shaggy@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.