Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)

[syzbot <syzbot+fa603ae6b02658401ca7@syzkaller.appspotmail.com>]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: shift-out-of-bounds in dbJoin

------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2885:11
shift exponent 132 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 128 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x385/0x410 lib/ubsan.c:494
 dbJoin+0x34f/0x380 fs/jfs/jfs_dmap.c:2885
 dbFreeBits+0x4e1/0xdb0 fs/jfs/jfs_dmap.c:2427
 dbFreeDmap fs/jfs/jfs_dmap.c:2176 [inline]
 dbFree+0x336/0x650 fs/jfs/jfs_dmap.c:485
 txFreeMap+0x7ff/0xde0 fs/jfs/jfs_txnmgr.c:2536
 txUpdateMap+0x308/0x9c0 fs/jfs/jfs_txnmgr.c:-1
 txLazyCommit fs/jfs/jfs_txnmgr.c:2666 [inline]
 jfs_lazycommit+0x3ef/0xa10 fs/jfs/jfs_txnmgr.c:2735
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 128 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 vpanic+0x56c/0xa60 kernel/panic.c:650
 panic+0xc5/0xd0 kernel/panic.c:787
 check_panic_on_warn+0x89/0xb0 kernel/panic.c:524
 __ubsan_handle_shift_out_of_bounds+0x385/0x410 lib/ubsan.c:494
 dbJoin+0x34f/0x380 fs/jfs/jfs_dmap.c:2885
 dbFreeBits+0x4e1/0xdb0 fs/jfs/jfs_dmap.c:2427
 dbFreeDmap fs/jfs/jfs_dmap.c:2176 [inline]
 dbFree+0x336/0x650 fs/jfs/jfs_dmap.c:485
 txFreeMap+0x7ff/0xde0 fs/jfs/jfs_txnmgr.c:2536
 txUpdateMap+0x308/0x9c0 fs/jfs/jfs_txnmgr.c:-1
 txLazyCommit fs/jfs/jfs_txnmgr.c:2666 [inline]
 jfs_lazycommit+0x3ef/0xa10 fs/jfs/jfs_txnmgr.c:2735
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled


Tested on:

commit:         d730905b Merge tag 'mips_7.1' of git://git.kernel.org/..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=16e2a4ce580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4bcfdf96e3f779b1
dashboard link: https://syzkaller.appspot.com/bug?extid=fa603ae6b02658401ca7
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15ea1906580000