* [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
@ 2025-07-14 17:53 syzbot
2025-07-14 18:31 ` syzbot
` (3 more replies)
0 siblings, 4 replies; 13+ messages in thread
From: syzbot @ 2025-07-14 17:53 UTC (permalink / raw)
To: agruenba, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 347e9f5043c8 Linux 6.16-rc6
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c070f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-347e9f50.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49ae91eb36e0/vmlinux-347e9f50.xz
kernel image: https://storage.googleapis.com/syzbot-assets/78497f74bd6b/bzImage-347e9f50.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
dir_e_read fs/gfs2/dir.c:1544 [inline]
gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
iterate_dir+0x5ac/0x770 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f97c858e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f97c94ce038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f97c87b5fa0 RCX: 00007f97c858e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f97c8610b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f97c87b5fa0 R15: 00007ffd76387a88
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
@ 2025-07-14 18:31 ` syzbot
2025-07-15 12:24 ` Andrew Price
2025-07-16 15:42 ` Andrew Price
2025-07-15 14:15 ` Forwarded: syzbot
` (2 subsequent siblings)
3 siblings, 2 replies; 13+ messages in thread
From: syzbot @ 2025-07-14 18:31 UTC (permalink / raw)
To: agruenba, gfs2, linux-kernel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 347e9f5043c8 Linux 6.16-rc6
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11afb18c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172470f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d0fd82580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-347e9f50.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49ae91eb36e0/vmlinux-347e9f50.xz
kernel image: https://storage.googleapis.com/syzbot-assets/78497f74bd6b/bzImage-347e9f50.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2445b7dba270/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15d7918c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5508 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
dir_e_read fs/gfs2/dir.c:1544 [inline]
gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
iterate_dir+0x5ac/0x770 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9672d8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd2be2c848 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f9672fb5fa0 RCX: 00007f9672d8e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f9672e10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9672fb5fa0 R14: 00007f9672fb5fa0 R15: 0000000000000003
</TASK>
---[ end trace ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-14 18:31 ` syzbot
@ 2025-07-15 12:24 ` Andrew Price
2025-07-15 12:45 ` syzbot
2025-07-16 15:42 ` Andrew Price
1 sibling, 1 reply; 13+ messages in thread
From: Andrew Price @ 2025-07-15 12:24 UTC (permalink / raw)
To: syzbot; +Cc: syzkaller-bugs, linux-kernel, gfs2, agruenba
On 14/07/2025 19:31, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 347e9f5043c8 Linux 6.16-rc6
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11afb18c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
> dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172470f0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d0fd82580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-347e9f50.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/49ae91eb36e0/vmlinux-347e9f50.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/78497f74bd6b/bzImage-347e9f50.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/2445b7dba270/mount_0.gz
> fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15d7918c580000)
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
>
> gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
> gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
> gfs2: fsid=syz:syz.s: first mount done, others may mount
> ------------[ cut here ]------------
> UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
> shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
> CPU: 0 UID: 0 PID: 5508 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
> __ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
> dir_e_read fs/gfs2/dir.c:1544 [inline]
> gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
> gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
> iterate_dir+0x5ac/0x770 fs/readdir.c:108
> __do_sys_getdents64 fs/readdir.c:410 [inline]
> __se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f9672d8e929
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd2be2c848 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
> RAX: ffffffffffffffda RBX: 00007f9672fb5fa0 RCX: 00007f9672d8e929
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
> RBP: 00007f9672e10b39 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f9672fb5fa0 R14: 00007f9672fb5fa0 R15: 0000000000000003
> </TASK>
> ---[ end trace ]---
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
#syz test
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -450,6 +450,10 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
gfs2_consist_inode(ip);
return -EIO;
}
+ if ((ip->i_diskflags & GFS2_DIF_EXHASH) && depth < ilog2(sdp->sd_hash_ptrs)) {
+ gfs2_consist_inode(ip);
+ return -EIO;
+ }
ip->i_depth = (u8)depth;
ip->i_entries = be32_to_cpu(str->di_entries);
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-15 12:24 ` Andrew Price
@ 2025-07-15 12:45 ` syzbot
2025-07-15 13:00 ` Andrew Price
0 siblings, 1 reply; 13+ messages in thread
From: syzbot @ 2025-07-15 12:45 UTC (permalink / raw)
To: agruenba, anprice, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in move_to_new_folio
------------[ cut here ]------------
gfs2_meta_aops does not implement migrate_folio
WARNING: CPU: 0 PID: 30 at mm/migrate.c:944 fallback_migrate_folio mm/migrate.c:942 [inline]
WARNING: CPU: 0 PID: 30 at mm/migrate.c:944 move_to_new_folio+0x696/0x7a0 mm/migrate.c:996
Modules linked in:
CPU: 0 UID: 0 PID: 30 Comm: kcompactd1 Not tainted 6.16.0-rc6-syzkaller-g155a3c003e55-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:fallback_migrate_folio mm/migrate.c:942 [inline]
RIP: 0010:move_to_new_folio+0x696/0x7a0 mm/migrate.c:996
Code: 0d 01 90 42 80 7c 3d 00 00 74 0a 48 8b 7c 24 20 e8 2f 53 fe ff 48 8b 44 24 20 48 8b 30 48 c7 c7 20 bb 97 8b e8 cb b5 5e ff 90 <0f> 0b 90 90 49 bf 00 00 00 00 00 fc ff df e9 7e fd ff ff e8 e2 d2
RSP: 0018:ffffc90000516fd0 EFLAGS: 00010246
RAX: 0ac1efce833f5700 RBX: ffffea0000d5d100 RCX: ffff888030f20000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 1ffff1100aaeabc5 R08: ffff88801fc24293 R09: 1ffff11003f84852
R10: dffffc0000000000 R11: ffffed1003f84853 R12: ffffea00015c8e00
R13: ffff888055755d08 R14: ffffea0000d5d108 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88808d21b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb6eacfe8 CR3: 0000000054de7000 CR4: 0000000000352ef0
Call Trace:
<TASK>
migrate_folio_move mm/migrate.c:1301 [inline]
migrate_folios_move mm/migrate.c:1653 [inline]
migrate_pages_batch+0x1c34/0x2830 mm/migrate.c:1900
migrate_pages_sync mm/migrate.c:1930 [inline]
migrate_pages+0x1bcc/0x2930 mm/migrate.c:2039
compact_zone+0x23f4/0x4ad0 mm/compaction.c:2683
compact_node+0x1d2/0x280 mm/compaction.c:2952
kcompactd+0xbc8/0x1290 mm/compaction.c:3250
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: 155a3c00 Merge tag 'for-6.16/dm-fixes-2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11eb8382580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=150808f0580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-15 12:45 ` syzbot
@ 2025-07-15 13:00 ` Andrew Price
0 siblings, 0 replies; 13+ messages in thread
From: Andrew Price @ 2025-07-15 13:00 UTC (permalink / raw)
To: agruenba, gfs2; +Cc: syzbot, linux-kernel, syzkaller-bugs
On 15/07/2025 13:45, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in move_to_new_folio
Known issue, fixed in for-next...
> console output: https://syzkaller.appspot.com/x/log.txt?x=11eb8382580000
Looks like it's hitting the new validation instead of the UB anyway.
Andy
^ permalink raw reply [flat|nested] 13+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-14 18:31 ` syzbot
@ 2025-07-15 14:15 ` syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
3 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-15 14:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
[not found] <CAMp3bLVK6iyX3ZrM7=VUp5RcHcDaTNMRxfYd-Jr2Qr+vzRw7bA@mail.gmail.com>
@ 2025-07-15 14:24 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-15 14:24 UTC (permalink / raw)
To: linux-kernel, purvayeshi550, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
fs/gfs2/ops_fstype.c:283:11: error: use of undeclared identifier 'EFSCORRUPTED'
Tested on:
commit: 155a3c00 Merge tag 'for-6.16/dm-fixes-2' of git://git...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=160208f0580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-14 18:31 ` syzbot
2025-07-15 14:15 ` Forwarded: syzbot
@ 2025-07-15 14:29 ` syzbot
2025-07-16 6:28 ` Forwarded: syzbot
3 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-15 14:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
[not found] <CAMp3bLUBvH+e1Zg+GhB7g+wDTfTi34F=fpPBXi=zQkE5sLBxsA@mail.gmail.com>
@ 2025-07-15 14:44 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-15 14:44 UTC (permalink / raw)
To: linux-kernel, purvayeshi550, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: shift-out-of-bounds in gfs2_dir_read
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5955 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller-g155a3c003e55-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
dir_e_read fs/gfs2/dir.c:1544 [inline]
gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
iterate_dir+0x5ac/0x770 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc24d78e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc24e530038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007fc24d9b5fa0 RCX: 00007fc24d78e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007fc24d810b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fc24d9b5fa0 R15: 00007fffd0c6e0b8
</TASK>
---[ end trace ]---
Tested on:
commit: 155a3c00 Merge tag 'for-6.16/dm-fixes-2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17c44382580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=167ff18c580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
` (2 preceding siblings ...)
2025-07-15 14:29 ` Forwarded: syzbot
@ 2025-07-16 6:28 ` syzbot
3 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-16 6:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
[not found] <CAMp3bLXm0gv=SWKwU_U6uBkxu12NawKyPPdrHVCYQDf-vyofdA@mail.gmail.com>
@ 2025-07-16 6:44 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-16 6:44 UTC (permalink / raw)
To: linux-kernel, purvayeshi550, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: shift-out-of-bounds in gfs2_dir_read
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5893 Comm: syz.0.16 Not tainted 6.16.0-rc6-syzkaller-g155a3c003e55-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
dir_e_read fs/gfs2/dir.c:1544 [inline]
gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
iterate_dir+0x5ac/0x770 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9c54f8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9c55da0038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f9c551b5fa0 RCX: 00007f9c54f8e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f9c55010b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9c551b5fa0 R15: 00007ffeba75d678
</TASK>
---[ end trace ]---
Tested on:
commit: 155a3c00 Merge tag 'for-6.16/dm-fixes-2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=122b88f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=1449a7d4580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-14 18:31 ` syzbot
2025-07-15 12:24 ` Andrew Price
@ 2025-07-16 15:42 ` Andrew Price
2025-07-16 16:03 ` syzbot
1 sibling, 1 reply; 13+ messages in thread
From: Andrew Price @ 2025-07-16 15:42 UTC (permalink / raw)
To: syzbot; +Cc: agruenba, gfs2, linux-kernel, syzkaller-bugs
On 14/07/2025 19:31, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 347e9f5043c8 Linux 6.16-rc6
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11afb18c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
> dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172470f0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d0fd82580000
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
2025-07-16 15:42 ` Andrew Price
@ 2025-07-16 16:03 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-07-16 16:03 UTC (permalink / raw)
To: agruenba, anprice, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
Tested-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
Tested on:
commit: 557c024c gfs2: Validate i_depth for exhash directories
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1125458c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29b1a0d7330d4a8
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2025-07-16 16:03 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-14 18:31 ` syzbot
2025-07-15 12:24 ` Andrew Price
2025-07-15 12:45 ` syzbot
2025-07-15 13:00 ` Andrew Price
2025-07-16 15:42 ` Andrew Price
2025-07-16 16:03 ` syzbot
2025-07-15 14:15 ` Forwarded: syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
[not found] <CAMp3bLVK6iyX3ZrM7=VUp5RcHcDaTNMRxfYd-Jr2Qr+vzRw7bA@mail.gmail.com>
2025-07-15 14:24 ` [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
[not found] <CAMp3bLUBvH+e1Zg+GhB7g+wDTfTi34F=fpPBXi=zQkE5sLBxsA@mail.gmail.com>
2025-07-15 14:44 ` syzbot
[not found] <CAMp3bLXm0gv=SWKwU_U6uBkxu12NawKyPPdrHVCYQDf-vyofdA@mail.gmail.com>
2025-07-16 6:44 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).