[v6.1] UBSAN: shift-out-of-bounds in dbUpdatePMap

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 2f3918bc53fb Linux 6.1.33
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=166967c7280000
kernel config: https://syzkaller.appspot.com/x/.config?x=64e29382e385f1b9
dashboard link: https://syzkaller.appspot.com/bug?extid=c398d37c5b23e0e0c9ca
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=140a0b1d280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17892f95280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f180a77b248f/disk-2f3918bc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/582d3206652e/vmlinux-2f3918bc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/20934119e0f6/Image-2f3918bc.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f95f73668fa0/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c398d3...@syzkaller.appspotmail.com

================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:470:12
shift exponent 131072 is too large for 64-bit type 'long long'
CPU: 0 PID: 91 Comm: jfsCommit Not tainted 6.1.33-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_shift_out_of_bounds+0x2f4/0x36c lib/ubsan.c:321
dbUpdatePMap+0xb74/0xcb8 fs/jfs/jfs_dmap.c:470
txAllocPMap+0x4a4/0x5e0 fs/jfs/jfs_txnmgr.c:2420
txUpdateMap+0x6e8/0x8e4 fs/jfs/jfs_txnmgr.c:2358
txLazyCommit fs/jfs/jfs_txnmgr.c:2659 [inline]
jfs_lazycommit+0x3a0/0x988 fs/jfs/jfs_txnmgr.c:2727
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7349e40704a0 Linux 5.15.116
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12e0e1fd280000
kernel config: https://syzkaller.appspot.com/x/.config?x=f650a0601dbf525d
dashboard link: https://syzkaller.appspot.com/bug?extid=c168963dcba8b242600d

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1542cc07280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1592992d280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eec1263e4f05/disk-7349e407.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/833d6ae016fd/vmlinux-7349e407.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da142afba386/Image-7349e407.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/1bafb252ea69/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+c16896...@syzkaller.appspotmail.com

================================================================================
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:470:12
shift exponent 131072 is too large for 64-bit type 'long long'

CPU: 0 PID: 239 Comm: jfsCommit Not tainted 5.15.116-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:

dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216

__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
ubsan_epilogue lib/ubsan.c:151 [inline]

__ubsan_handle_shift_out_of_bounds+0x2f8/0x378 lib/ubsan.c:321
dbUpdatePMap+0xb58/0xcc0 fs/jfs/jfs_dmap.c:470
txAllocPMap+0x4a4/0x5e0 fs/jfs/jfs_txnmgr.c:2454
txUpdateMap+0x718/0x914 fs/jfs/jfs_txnmgr.c:2392
txLazyCommit fs/jfs/jfs_txnmgr.c:2693 [inline]
jfs_lazycommit+0x3b0/0xa40 fs/jfs/jfs_txnmgr.c:2761
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

[syzbot]

syzbot suspects this issue was fixed by commit:

commit c7feb54b113802d2aba98708769d3c33fb017254
Author: Siddh Raman Pant <co...@siddh.me>
Date: Tue Jun 20 16:47:00 2023 +0000

jfs: jfs_dmap: Validate db_l2nbperpage while mounting

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1649ca01680000
start commit: 2f3918bc53fb Linux 6.1.33
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=64e29382e385f1b9
dashboard link: https://syzkaller.appspot.com/bug?extid=c398d37c5b23e0e0c9ca

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=140a0b1d280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17892f95280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: jfs: jfs_dmap: Validate db_l2nbperpage while mounting

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.