Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in diWrite

diWrite: Offset too large
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:754:4
index 255 is out of range for type 'struct dtslot[128]'
CPU: 1 PID: 5407 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-10396-g4652b8e4f3ff-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b5/0x2a0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0xf0/0x120 lib/ubsan.c:348
 diWrite+0x1168/0x2060 fs/jfs/jfs_imap.c:754
 txCommit+0xa03/0x6a00 fs/jfs/jfs_txnmgr.c:1255
 jfs_mkdir+0x8d7/0xad0 fs/jfs/namei.c:290
 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106
 do_mkdirat+0x255/0x390 fs/namei.c:4129
 __do_sys_mkdirat fs/namei.c:4144 [inline]
 __se_sys_mkdirat fs/namei.c:4142 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4142
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fa34307ad39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa3441290c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fa34319bf80 RCX: 00007fa34307ad39
RDX: 00000000000001ff RSI: 00000000200000c0 RDI: ffffffffffffff9c
RBP: 00007fa3430d7567 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fa34319bf80 R15: 00007ffd3c0fbd48
 </TASK>
================================================================================


Tested on:

commit:         4652b8e4 Merge tag '6.7-rc-ksmbd-server-fixes' of git:..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=15fb1f07680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8aa5f62c74d2e2d5
dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10e93ef7680000

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in diWrite

diWrite: Offset too large
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:754:4
index 255 is out of range for type 'struct dtslot[128]'
CPU: 0 PID: 5416 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-11928-gbc3012f4e3a9-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b5/0x2a0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0xf0/0x120 lib/ubsan.c:348
 diWrite+0x148c/0x2020 fs/jfs/jfs_imap.c:754
 txCommit+0xa03/0x6a00 fs/jfs/jfs_txnmgr.c:1255
 jfs_mkdir+0x8d7/0xad0 fs/jfs/namei.c:290
 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106
 do_mkdirat+0x255/0x390 fs/namei.c:4129
 __do_sys_mkdirat fs/namei.c:4144 [inline]
 __se_sys_mkdirat fs/namei.c:4142 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4142
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fefe747ad39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fefe859c0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fefe759bf80 RCX: 00007fefe747ad39
RDX: 00000000000001ff RSI: 00000000200000c0 RDI: ffffffffffffff9c
RBP: 00007fefe74d7567 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fefe759bf80 R15: 00007ffd5e8e9838
 </TASK>
================================================================================


Tested on:

commit:         bc3012f4 Merge tag 'v6.7-p1' of git://git.kernel.org/p..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10ece56b680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=aa4ab0f6bdaaea8a
dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17fe65a0e80000

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/jfs/jfs_imap.c:752:16: error: expected ';' after return statement


Tested on:

commit:         8f6f76a6 Merge tag 'mm-nonmm-stable-2023-11-02-14-08' ..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config:  https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15f5e627680000

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in txUnlock

BUG at fs/jfs/jfs_txnmgr.c:931 assert(mp->nohomeok > 0)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_txnmgr.c:931!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 107 Comm: jfsCommit Not tainted 6.6.0-syzkaller-12401-g8f6f76a6a29f-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:txUnlock+0xc6e/0xca0 fs/jfs/jfs_txnmgr.c:931
Code: 18 58 4b 07 0f 0b e8 f1 9a 7b fe 48 c7 c7 40 ed e2 8a 48 c7 c6 39 e9 e2 8a ba a3 03 00 00 48 c7 c1 20 fa e2 8a e8 f2 57 4b 07 <0f> 0b e8 cb 9a 7b fe 48 c7 c7 40 ed e2 8a 48 c7 c6 39 e9 e2 8a ba
RSP: 0018:ffffc90002cafce8 EFLAGS: 00010246
RAX: 0000000000000037 RBX: 0000000000000000 RCX: af7f11a66accc000
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffff888027157aa8 R08: ffffffff816e5b5c R09: 1ffff92000595f3c
R10: dffffc0000000000 R11: fffff52000595f3d R12: 0000000000000a06
R13: 0000000000000000 R14: ffffc90002802000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555660e938 CR3: 0000000027c28000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 jfs_lazycommit+0x5d4/0xb80 fs/jfs/jfs_txnmgr.c:2682
 kthread+0x2cd/0x360 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:txUnlock+0xc6e/0xca0 fs/jfs/jfs_txnmgr.c:931
Code: 18 58 4b 07 0f 0b e8 f1 9a 7b fe 48 c7 c7 40 ed e2 8a 48 c7 c6 39 e9 e2 8a ba a3 03 00 00 48 c7 c1 20 fa e2 8a e8 f2 57 4b 07 <0f> 0b e8 cb 9a 7b fe 48 c7 c7 40 ed e2 8a 48 c7 c6 39 e9 e2 8a ba
RSP: 0018:ffffc90002cafce8 EFLAGS: 00010246
RAX: 0000000000000037 RBX: 0000000000000000 RCX: af7f11a66accc000
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffff888027157aa8 R08: ffffffff816e5b5c R09: 1ffff92000595f3c
R10: dffffc0000000000 R11: fffff52000595f3d R12: 0000000000000a06
R13: 0000000000000000 R14: ffffc90002802000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555660e938 CR3: 0000000026057000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit:         8f6f76a6 Merge tag 'mm-nonmm-stable-2023-11-02-14-08' ..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1751405b680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f696cf620c46c5db
dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1022abe3680000

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <jack@suse.cz>
Date:   Wed Nov 1 17:43:10 2023 +0000

    fs: Block writes to mounted block devices

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17ec162be80000
start commit:   493ffd6605b2 Merge tag 'ucount-rlimits-cleanups-for-v5.19'..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12f431d2880000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1208894a880000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: Block writes to mounted block devices

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[Jan Kara]

On Sat 13-01-24 23:18:05, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit 6f861765464f43a71462d52026fbddfc858239a5
> Author: Jan Kara <jack@suse.cz>
> Date:   Wed Nov 1 17:43:10 2023 +0000
> 
>     fs: Block writes to mounted block devices
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17ec162be80000
> start commit:   493ffd6605b2 Merge tag 'ucount-rlimits-cleanups-for-v5.19'..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
> dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12f431d2880000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1208894a880000
> 
> If the result looks correct, please mark the issue as fixed by replying with:

Makes sense:

#syz fix: fs: Block writes to mounted block devices

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diWrite

[Christian Brauner]

On Mon, Jan 15, 2024 at 02:42:28PM +0100, Jan Kara wrote:
> On Sat 13-01-24 23:18:05, syzbot wrote:
> > syzbot suspects this issue was fixed by commit:
> > 
> > commit 6f861765464f43a71462d52026fbddfc858239a5
> > Author: Jan Kara <jack@suse.cz>
> > Date:   Wed Nov 1 17:43:10 2023 +0000
> > 
> >     fs: Block writes to mounted block devices
> > 
> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17ec162be80000
> > start commit:   493ffd6605b2 Merge tag 'ucount-rlimits-cleanups-for-v5.19'..
> > git tree:       upstream
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=d19f5d16783f901
> > dashboard link: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12f431d2880000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1208894a880000
> > 
> > If the result looks correct, please mark the issue as fixed by replying with:
> 
> Makes sense:
> 
> #syz fix: fs: Block writes to mounted block devices

I love how many things this closes. This is awesome!