* [PATCH v2] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-10-25 6:49 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
@ 2024-10-25 15:24 ` Matt Jan
2024-10-25 15:39 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
2024-10-25 16:30 ` [syzbot] [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits syzbot
` (3 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Matt Jan @ 2024-10-25 15:24 UTC (permalink / raw)
To: Dave Kleikamp, jfs-discussion, linux-kernel, Shuah Khan
Cc: Matt Jan, syzbot+9e90a1c5eedb9dc4c6cc
The starting bit number of free bits should not be >= 32 as it is
0-indexed.Assert that the number of bits is < 32, or if it is 32, the
input word must be 0.
#syz test
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Signed-off-by: Matt Jan <zoo868e@gmail.com>
---
Changes in v2: Test if the patch resolve the issue through syzbot and
reference the reporter.
fs/jfs/jfs_dmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 974ecf5e0d95..b9eccf8900eb 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3015,7 +3015,7 @@ static int dbFindBits(u32 word, int l2nb)
/* get the number of bits.
*/
nb = 1 << l2nb;
- assert(nb <= DBWORD);
+ assert(nb < DBWORD || (nb == DBWORD && !word));
/* complement the word so we can use a mask (i.e. 0s represent
* free bits) and compute the mask.
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2)
2024-10-25 15:24 ` [PATCH v2] jfs: UBSAN: shift-out-of-bounds in dbFindBits Matt Jan
@ 2024-10-25 15:39 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2024-10-25 15:39 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, skhan, syzkaller-bugs,
zoo868e
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in dbFindBits
ERROR: (device loop0): dbAllocBits: leaf page corrupt
BUG at fs/jfs/jfs_dmap.c:3018 assert(nb < DBWORD || (nb == DBWORD && !word))
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_dmap.c:3018!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5606 Comm: syz.0.15 Not tainted 6.12.0-rc4-syzkaller-00161-gae90f6a6170d-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:dbFindBits+0x1dc/0x210 fs/jfs/jfs_dmap.c:3018
Code: e9 fa fe ff ff e8 74 40 68 fe 48 c7 c7 00 33 43 8c 48 c7 c6 40 30 43 8c ba ca 0b 00 00 48 c7 c1 c0 3a 43 8c e8 65 30 97 08 90 <0f> 0b e8 4d 40 68 fe 48 c7 c7 00 33 43 8c 48 c7 c6 40 30 43 8c ba
RSP: 0018:ffffc9000b107940 EFLAGS: 00010246
RAX: 000000000000004c RBX: ffff88801f140800 RCX: 37b0eb8928fc2800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000020 R08: ffffffff81749f8c R09: 1ffff92001620ec4
R10: dffffc0000000000 R11: fffff52001620ec5 R12: 0000000000000020
R13: 1ffff92001620f38 R14: 00000000ffffffff R15: 0000000000000005
FS: 00007fd1f83196c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ea5ffff CR3: 00000000415e4000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
dbAllocDmapLev+0x1e9/0x4a0 fs/jfs/jfs_dmap.c:1985
dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1825
dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613
jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105
jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd1f757dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd1f8319038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd1f7735f80 RCX: 00007fd1f757dff9
RDX: 00000000200000c0 RSI: 00000000c0185879 RDI: 0000000000000004
RBP: 00007fd1f75f0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd1f7735f80 R15: 00007ffdd2e520e8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dbFindBits+0x1dc/0x210 fs/jfs/jfs_dmap.c:3018
Code: e9 fa fe ff ff e8 74 40 68 fe 48 c7 c7 00 33 43 8c 48 c7 c6 40 30 43 8c ba ca 0b 00 00 48 c7 c1 c0 3a 43 8c e8 65 30 97 08 90 <0f> 0b e8 4d 40 68 fe 48 c7 c7 00 33 43 8c 48 c7 c6 40 30 43 8c ba
RSP: 0018:ffffc9000b107940 EFLAGS: 00010246
RAX: 000000000000004c RBX: ffff88801f140800 RCX: 37b0eb8928fc2800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000020 R08: ffffffff81749f8c R09: 1ffff92001620ec4
R10: dffffc0000000000 R11: fffff52001620ec5 R12: 0000000000000020
R13: 1ffff92001620f38 R14: 00000000ffffffff R15: 0000000000000005
FS: 00007fd1f83196c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ea5ffff CR3: 00000000415e4000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: ae90f6a6 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=166868a7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=fc6f8ce8c5369043
dashboard link: https://syzkaller.appspot.com/bug?extid=9e90a1c5eedb9dc4c6cc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10a7de40580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-10-25 6:49 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
2024-10-25 15:24 ` [PATCH v2] jfs: UBSAN: shift-out-of-bounds in dbFindBits Matt Jan
@ 2024-10-25 16:30 ` syzbot
2024-10-25 17:00 ` Matt Jan
` (2 subsequent siblings)
4 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2024-10-25 16:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits
Author: zoo868e@gmail.com
The starting bit number of free bits should not be >= 32 as it is
0-indexed.Assert that the number of bits is < 32, or if it is 32, the
input word must be 0.
#syz test
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Signed-off-by: Matt Jan <zoo868e@gmail.com>
---
Changes in v3: return the result earlier instead of assert
Changes in v2: Test if the patch resolve the issue through syzbot and
reference the reporter.
fs/jfs/jfs_dmap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 974ecf5e0d95..346f2617b744 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3017,6 +3017,9 @@ static int dbFindBits(u32 word, int l2nb)
nb = 1 << l2nb;
assert(nb <= DBWORD);
+ if (nb == DBWORD)
+ return (!!word) << BUDMIN;
+
/* complement the word so we can use a mask (i.e. 0s represent
* free bits) and compute the mask.
*/
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-10-25 6:49 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
2024-10-25 15:24 ` [PATCH v2] jfs: UBSAN: shift-out-of-bounds in dbFindBits Matt Jan
2024-10-25 16:30 ` [syzbot] [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits syzbot
@ 2024-10-25 17:00 ` Matt Jan
2024-10-25 17:20 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
2024-10-30 15:15 ` [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits Dave Kleikamp
2024-11-01 9:59 ` [PATCH v4] " Matt Jan
2025-09-28 1:00 ` Forwarded: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
4 siblings, 2 replies; 11+ messages in thread
From: Matt Jan @ 2024-10-25 17:00 UTC (permalink / raw)
To: Dave Kleikamp, jfs-discussion, linux-kernel, Shuah Khan
Cc: Matt Jan, syzbot+9e90a1c5eedb9dc4c6cc
Return immediately if the needed free bits span a full word to avoid
out-of-bounds shifting.
#syz test
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Signed-off-by: Matt Jan <zoo868e@gmail.com>
---
Changes in v3: Return the result earlier instead of assert it
Changes in v2: Test if the patch resolve the issue through syzbot and
reference the reporter.
fs/jfs/jfs_dmap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 974ecf5e0d95..45b7a393b769 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3012,6 +3012,11 @@ static int dbFindBits(u32 word, int l2nb)
int bitno, nb;
u32 mask;
+ /* return immediately if the number of free bits is a word
+ */
+ if (l2nb == BUDMIN)
+ return (!!word) << BUDMIN;
+
/* get the number of bits.
*/
nb = 1 << l2nb;
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2)
2024-10-25 17:00 ` Matt Jan
@ 2024-10-25 17:20 ` syzbot
2024-10-30 15:15 ` [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits Dave Kleikamp
1 sibling, 0 replies; 11+ messages in thread
From: syzbot @ 2024-10-25 17:20 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, skhan, syzkaller-bugs,
zoo868e
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Tested-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Tested on:
commit: ae90f6a6 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1274aebb980000
kernel config: https://syzkaller.appspot.com/x/.config?x=fc6f8ce8c5369043
dashboard link: https://syzkaller.appspot.com/bug?extid=9e90a1c5eedb9dc4c6cc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1254aebb980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-10-25 17:00 ` Matt Jan
2024-10-25 17:20 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
@ 2024-10-30 15:15 ` Dave Kleikamp
1 sibling, 0 replies; 11+ messages in thread
From: Dave Kleikamp @ 2024-10-30 15:15 UTC (permalink / raw)
To: Matt Jan, jfs-discussion, linux-kernel, Shuah Khan
Cc: syzbot+9e90a1c5eedb9dc4c6cc
On 10/25/24 12:00PM, Matt Jan wrote:
> Return immediately if the needed free bits span a full word to avoid
> out-of-bounds shifting.
dbFindBits really shouldn't be called with l2nb == BUDMIN. Something in
the dmap is corrupt and this patch just lets things continue as if
nothing is wrong. I think a sanity check in dbAllocDmapLev where we can
return -EIO makes more sense.
Shaggy
>
> #syz test
>
> Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
> Signed-off-by: Matt Jan <zoo868e@gmail.com>
> ---
> Changes in v3: Return the result earlier instead of assert it
> Changes in v2: Test if the patch resolve the issue through syzbot and
> reference the reporter.
>
> fs/jfs/jfs_dmap.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 974ecf5e0d95..45b7a393b769 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -3012,6 +3012,11 @@ static int dbFindBits(u32 word, int l2nb)
> int bitno, nb;
> u32 mask;
>
> + /* return immediately if the number of free bits is a word
> + */
> + if (l2nb == BUDMIN)
> + return (!!word) << BUDMIN;
> +
> /* get the number of bits.
> */
> nb = 1 << l2nb;
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v4] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-10-25 6:49 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
` (2 preceding siblings ...)
2024-10-25 17:00 ` Matt Jan
@ 2024-11-01 9:59 ` Matt Jan
2024-11-01 10:20 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
2024-12-02 20:53 ` [PATCH v4] jfs: UBSAN: shift-out-of-bounds in dbFindBits Dave Kleikamp
2025-09-28 1:00 ` Forwarded: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
4 siblings, 2 replies; 11+ messages in thread
From: Matt Jan @ 2024-11-01 9:59 UTC (permalink / raw)
To: Dave Kleikamp, jfs-discussion, linux-kernel, Shuan Khan
Cc: Matt Jan, syzbot+9e90a1c5eedb9dc4c6cc
Ensure l2nb is less than BUDMIN by performing a sanity check in the caller.
Return -EIO if the check fails.
#syz test
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Signed-off-by: Matt Jan <zoo868e@gmail.com>
---
Changes in v4: Thanks to Shaggy for the review. We now perform a sanity check instead of continuing as if nothing is wrong.
Changes in v3: Return the result earlier instead of assert it
Changes in v2: Test if the patch resolve the issue through syzbot and reference the reporter
fs/jfs/jfs_dmap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 974ecf5e0d95..89c22a18314f 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1217,7 +1217,7 @@ dbAllocNear(struct bmap * bmp,
int word, lword, rc;
s8 *leaf;
- if (dp->tree.leafidx != cpu_to_le32(LEAFIND)) {
+ if (dp->tree.leafidx != cpu_to_le32(LEAFIND) || l2nb >= L2DBWORD) {
jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmap page\n");
return -EIO;
}
@@ -1969,7 +1969,7 @@ dbAllocDmapLev(struct bmap * bmp,
if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
return -ENOSPC;
- if (leafidx < 0)
+ if (leafidx < 0 || l2nb >= L2DBWORD)
return -EIO;
/* determine the block number within the file system corresponding
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2)
2024-11-01 9:59 ` [PATCH v4] " Matt Jan
@ 2024-11-01 10:20 ` syzbot
2024-12-02 20:53 ` [PATCH v4] jfs: UBSAN: shift-out-of-bounds in dbFindBits Dave Kleikamp
1 sibling, 0 replies; 11+ messages in thread
From: syzbot @ 2024-11-01 10:20 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, skhan, syzkaller-bugs,
zoo868e
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Tested-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
Tested on:
commit: 6c52d4da Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116eb2a7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=35698c25466f388c
dashboard link: https://syzkaller.appspot.com/bug?extid=9e90a1c5eedb9dc4c6cc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1293e6f7980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v4] jfs: UBSAN: shift-out-of-bounds in dbFindBits
2024-11-01 9:59 ` [PATCH v4] " Matt Jan
2024-11-01 10:20 ` [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
@ 2024-12-02 20:53 ` Dave Kleikamp
1 sibling, 0 replies; 11+ messages in thread
From: Dave Kleikamp @ 2024-12-02 20:53 UTC (permalink / raw)
To: Matt Jan, jfs-discussion, linux-kernel, Shuan Khan
Cc: syzbot+9e90a1c5eedb9dc4c6cc
On 11/1/24 4:59AM, Matt Jan wrote:
> Ensure l2nb is less than BUDMIN by performing a sanity check in the caller.
> Return -EIO if the check fails.
Sorry for the delay again, but I'm still not okay with this patch.
It's possible for l2nb to be greater than L2DBWORD if and only if the
entire dmap page represents free space.
In dbAllocNear, there is a test:
if (leaf[word] < l2nb)
before dbFindbits is called. This will prevent the problem in dbFindbits
from this path. The problem still remains in dbAllocDmapLev since there
is no similar check.
>
> #syz test
>
> Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
> Signed-off-by: Matt Jan <zoo868e@gmail.com>
> ---
> Changes in v4: Thanks to Shaggy for the review. We now perform a sanity check instead of continuing as if nothing is wrong.
> Changes in v3: Return the result earlier instead of assert it
> Changes in v2: Test if the patch resolve the issue through syzbot and reference the reporter
>
> fs/jfs/jfs_dmap.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 974ecf5e0d95..89c22a18314f 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -1217,7 +1217,7 @@ dbAllocNear(struct bmap * bmp,
> int word, lword, rc;
> s8 *leaf;
>
> - if (dp->tree.leafidx != cpu_to_le32(LEAFIND)) {
> + if (dp->tree.leafidx != cpu_to_le32(LEAFIND) || l2nb >= L2DBWORD) {
> jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmap page\n");
> return -EIO;
> }
> @@ -1969,7 +1969,7 @@ dbAllocDmapLev(struct bmap * bmp,
> if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
> return -ENOSPC;
>
> - if (leafidx < 0)
> + if (leafidx < 0 || l2nb >= L2DBWORD)
> return -EIO;
>
> /* determine the block number within the file system corresponding
^ permalink raw reply [flat|nested] 11+ messages in thread
* Forwarded: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2)
2024-10-25 6:49 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2) syzbot
` (3 preceding siblings ...)
2024-11-01 9:59 ` [PATCH v4] " Matt Jan
@ 2025-09-28 1:00 ` syzbot
4 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2025-09-28 1:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbFindBits (2)
Author: xandfury@gmail.com
syzbot <syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com> writes:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: c2ee9f594da8 KVM: selftests: Fix build on on non-x86 archi..
> git tree: upstream
> console output: <https://syzkaller.appspot.com/x/log.txt?x=134fc640580000>
> kernel config: <https://syzkaller.appspot.com/x/.config?x=fc6f8ce8c5369043>
> dashboard link: <https://syzkaller.appspot.com/bug?extid=9e90a1c5eedb9dc4c6cc>
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: <https://syzkaller.appspot.com/x/repro.syz?x=118f0287980000>
> C reproducer: <https://syzkaller.appspot.com/x/repro.c?x=128f8a5f980000>
>
> Downloadable assets:
> disk image (non-bootable): <https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-c2ee9f59.raw.xz>
> vmlinux: <https://storage.googleapis.com/syzbot-assets/8a3541902b13/vmlinux-c2ee9f59.xz>
> kernel image: <https://storage.googleapis.com/syzbot-assets/a00efacc2604/bzImage-c2ee9f59.xz>
> mounted in repro: <https://storage.googleapis.com/syzbot-assets/0a96c5cc2569/mount_0.gz>
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9e90a1c5eedb9dc4c6cc@syzkaller.appspotmail.com
>
> ERROR: (device loop0): remounting filesystem as read-only
> ERROR: (device loop0): dbDiscardAG: -EIO
> ERROR: (device loop0): dbAllocBits: leaf page corrupt
> ————[ cut here ]————
> UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:3028:55
> shift exponent 32 is too large for 32-bit type ’u32’ (aka ’unsigned int’)
> CPU: 0 UID: 0 PID: 5092 Comm: syz-executor128 Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> ubsan_epilogue lib/ubsan.c:231 [inline]
> __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
> dbFindBits+0x11a/0x1d0 fs/jfs/jfs_dmap.c:3028
> dbAllocDmapLev+0x1e9/0x4a0 fs/jfs/jfs_dmap.c:1985
> dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1825
> dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1364
> dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613
> jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105
> jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:907 [inline]
> __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f54e7034c99
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89
> f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
> f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd37b5c358 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f54e7034c99
> RDX: 00000000200000c0 RSI: 00000000c0185879 RDI: 0000000000000004
> RBP: 00007f54e70ad5f0 R08: 000055557b4874c0 R09: 000055557b4874c0
> R10: 000055557b4874c0 R11: 0000000000000246 R12: 00007ffd37b5c380
> R13: 00007ffd37b5c5a8 R14: 431bde82d7b634db R15: 00007f54e707d03b
> </TASK>
> —[ end trace ]—
>
>
> —
> This report is generated by a bot. It may contain errors.
> See <https://goo.gl/tpsmEJ> for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> <https://goo.gl/tpsmEJ#status> for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report’s subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 11+ messages in thread