From: syzbot <syzbot+4b717071f1eecb2972df@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
xiaopei01@kylinos.cn
Subject: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbAllocAG (3)
Date: Fri, 17 Oct 2025 03:52:02 -0700 [thread overview]
Message-ID: <68f21fd2.050a0220.91a22.041b.GAE@google.com> (raw)
In-Reply-To: <d5067a639f2341e6cce0a48f810c22d2e36c33a8.1760688719.git.xiaopei01@kylinos.cn>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in dbAllocAG
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6656 at fs/jfs/jfs_dmap.c:1440 dbAllocAG+0xd67/0x1080 fs/jfs/jfs_dmap.c:1440
Modules linked in:
CPU: 1 UID: 0 PID: 6656 Comm: syz.0.22 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:dbAllocAG+0xd67/0x1080 fs/jfs/jfs_dmap.c:1440
Code: 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 fe e7 e6 fe 48 8b 3b 48 c7 c6 a0 1a 24 8b e9 d2 f9 ff ff e8 ea 35 85 fe 90 <0f> 0b 90 48 8b 44 24 78 42 0f b6 04 20 84 c0 0f 85 d5 02 00 00 48
RSP: 0018:ffffc90004e4f300 EFLAGS: 00010293
RAX: ffffffff8339c746 RBX: ffff888036d4f000 RCX: ffff88802e0a8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000002 R12: dffffc0000000000
R13: 0000000000000155 R14: 0000000000000000 R15: 00000000000000ff
FS: 00007efe0bfed6c0(0000) GS:ffff888126cc6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000565151f06950 CR3: 0000000041956000 CR4: 00000000003526f0
Call Trace:
<TASK>
dbAlloc+0x5a8/0xba0 fs/jfs/jfs_dmap.c:877
extBalloc fs/jfs/jfs_extent.c:336 [inline]
extAlloc+0x54a/0xfb0 fs/jfs/jfs_extent.c:127
jfs_get_block+0x346/0xab0 fs/jfs/inode.c:254
__block_write_begin_int+0x6b5/0x1900 fs/buffer.c:2145
block_write_begin+0x8a/0x120 fs/buffer.c:2256
jfs_write_begin+0x35/0x80 fs/jfs/inode.c:306
generic_perform_write+0x29d/0x8c0 mm/filemap.c:4242
generic_file_write_iter+0x118/0x550 mm/filemap.c:4385
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5d5/0xb40 fs/read_write.c:686
ksys_write+0x14b/0x260 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efe0c99eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efe0bfed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007efe0cbf6090 RCX: 00007efe0c99eec9
RDX: 0000000000000014 RSI: 0000200000000380 RDI: 0000000000000005
RBP: 00007efe0ca21f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efe0cbf6128 R14: 00007efe0cbf6090 R15: 00007ffeba24aff8
</TASK>
Tested on:
commit: 98ac9cc4 Merge tag 'f2fs-fix-6.18-rc2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1606cb04580000
kernel config: https://syzkaller.appspot.com/x/.config?x=af9170887d81dea1
dashboard link: https://syzkaller.appspot.com/bug?extid=4b717071f1eecb2972df
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=17cfbdcd980000
next prev parent reply other threads:[~2025-10-17 10:52 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-17 4:35 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbAllocAG (3) syzbot
2025-10-17 8:13 ` [PATCH] jfs: test syz test Pei Xiao
2025-10-17 8:24 ` Pei Xiao
2025-10-17 10:52 ` syzbot [this message]
2025-10-17 19:25 ` Forwarded: UBSAN: shift-out-of-bounds in dbAllocAG (3) syzbot
2025-10-17 20:13 ` syzbot
2026-04-17 10:12 ` Forwarded: [PATCH] jfs: validate budmin from dmapctl to prevent shift-out-of-bounds syzbot
2026-04-17 16:20 ` Forwarded: Re: [syzbot] UBSAN: shift-out-of-bounds in dbAllocAG syzbot
[not found] <20251017192527.214711-1-hsukrut3@gmail.com>
2025-10-17 19:46 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbAllocAG (3) syzbot
[not found] <20251017201304.218523-1-hsukrut3@gmail.com>
2025-10-17 21:05 ` syzbot
[not found] <20260417101203.2489628-1-tristmd@gmail.com>
2026-04-17 10:33 ` syzbot
[not found] <177644282959.3787227.1651052329897208294@talencesecurity.com>
2026-04-17 17:36 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68f21fd2.050a0220.91a22.041b.GAE@google.com \
--to=syzbot+4b717071f1eecb2972df@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xiaopei01@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.