Forwarded: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)

syzbot
2026-04-17T19:19:33Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)
Author: tristmd@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2770,6 +2770,10 @@ static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
int budsz, buddy;
s8 *leaf;

+ if (newval < 0 ||
+ (newval >= tp->dmt_budmin && newval - tp->dmt_budmin >= 32))
+ return -EIO;
+
/* can the new leaf value require a join with other leaves ?
*/
if (newval >= tp->dmt_budmin) {