[syzbot] [jfs?] UBSAN: shift-out-of-bounds in jfs_statfs (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7c6a3a65ace7 minmax: reduce min/max macro expansion in ato..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15105807980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c9e296880039df9
dashboard link: https://syzkaller.appspot.com/bug?extid=bb0aa125eb8d70475ebd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/06208dec0174/disk-7c6a3a65.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bd09f189e9df/vmlinux-7c6a3a65.xz
kernel image: https://storage.googleapis.com/syzbot-assets/25e56ca1462d/bzImage-7c6a3a65.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb0aa1...@syzkaller.appspotmail.com

------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/super.c:140:14
shift exponent 770 is too large for 64-bit type 's64' (aka 'long long')
CPU: 0 UID: 0 PID: 8224 Comm: syz.2.276 Not tainted 6.11.0-rc7-syzkaller-00021-g7c6a3a65ace7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
ubsan_epilogue lib/ubsan.c:231 [inline]
__ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
jfs_statfs+0x503/0x510 fs/jfs/super.c:140
statfs_by_dentry fs/statfs.c:66 [inline]
vfs_statfs+0x13b/0x2c0 fs/statfs.c:90
ovl_check_namelen fs/overlayfs/super.c:375 [inline]
ovl_lower_dir fs/overlayfs/super.c:391 [inline]
ovl_get_lowerstack fs/overlayfs/super.c:1132 [inline]
ovl_fill_super+0x8ed/0x3560 fs/overlayfs/super.c:1392
vfs_get_super fs/super.c:1280 [inline]
get_tree_nodev+0xb7/0x140 fs/super.c:1299
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
do_new_mount+0x2be/0xb40 fs/namespace.c:3472
do_mount fs/namespace.c:3812 [inline]
__do_sys_mount fs/namespace.c:4020 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f54f4d7def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f54f5b25038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f54f4f35f80 RCX: 00007f54f4d7def9
RDX: 0000000020000180 RSI: 0000000020000140 RDI: 0000000000000000
RBP: 00007f54f4df0b76 R08: 00000000200001c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f54f4f35f80 R15: 00007fff0587cfb8
</TASK>
---[ end trace ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hui Guo]

Hi Kernel Maintainers,
Thank you for your attention to this bug, we have reproduced this bug successfully, Hopefully this information will help you understand and fix the bug.
The reproduction information is as follows


HEAD Commit: 28eb75e178d389d325f1666e422bc13bbbb9804c(Merge tag 'drm-next-2024-11-21')
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=f73436f88b198e63

console output: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/28eb75e178d389d325f1666e422bc13bbbb9804c/de1718d891599e73792115d0262b8c4b6a0b4567/log0
repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/28eb75e178d389d325f1666e422bc13bbbb9804c/de1718d891599e73792115d0262b8c4b6a0b4567/repro.report
syz reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/28eb75e178d389d325f1666e422bc13bbbb9804c/de1718d891599e73792115d0262b8c4b6a0b4567/repro.prog
c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/28eb75e178d389d325f1666e422bc13bbbb9804c/de1718d891599e73792115d0262b8c4b6a0b4567/repro.cprog


Please let me know if there is anything I can help.
Best,
Hui Guo

This is the crash log I got by reproducing the bug based on the above environment，
I have piped this log through decode_stacktrace.sh to better understand the cause of the bug.
================================================================================
2024/11/28 03:39:14 parsed 1 programs
[ 591.765484][T12148] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 593.620088][T12190] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 593.622103][T12190] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 593.624181][T12190] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 593.625752][T12190] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 593.627999][T12190] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 593.629065][T12190] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 593.749818][ T59] audit: type=1401 audit(1732765162.841:12): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
[ 593.984161][ T94] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 593.985117][ T94] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 594.030015][ T94] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 594.031128][ T94] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 594.052912][T12177] chnl_net:caif_netlink_parms(): no params data found
[ 594.113098][T12177] bridge0: port 1(bridge_slave_0) entered blocking state
[ 594.114098][T12177] bridge0: port 1(bridge_slave_0) entered disabled state
[ 594.114954][T12177] bridge_slave_0: entered allmulticast mode
[ 594.116212][T12177] bridge_slave_0: entered promiscuous mode
[ 594.118814][T12177] bridge0: port 2(bridge_slave_1) entered blocking state
[ 594.119659][T12177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 594.120949][T12177] bridge_slave_1: entered allmulticast mode
[ 594.122256][T12177] bridge_slave_1: entered promiscuous mode
[ 594.149756][T12177] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 594.152146][T12177] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 594.175807][T12177] team0: Port device team_slave_0 added
[ 594.178394][T12177] team0: Port device team_slave_1 added
[ 594.209390][T12177] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 594.210494][T12177] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be.
[ 594.214700][T12177] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 594.218618][T12177] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 594.219572][T12177] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be.
[ 594.223047][T12177] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 594.251372][T12177] hsr_slave_0: entered promiscuous mode
[ 594.252692][T12177] hsr_slave_1: entered promiscuous mode
[ 594.351634][T12177] netdevsim netdevsim13 netdevsim0: renamed from eth0
[ 594.354138][T12177] netdevsim netdevsim13 netdevsim1: renamed from eth1
[ 594.356356][T12177] netdevsim netdevsim13 netdevsim2: renamed from eth2
[ 594.358391][T12177] netdevsim netdevsim13 netdevsim3: renamed from eth3
[ 594.368917][T12177] bridge0: port 2(bridge_slave_1) entered blocking state
[ 594.369852][T12177] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 594.370843][T12177] bridge0: port 1(bridge_slave_0) entered blocking state
[ 594.371779][T12177] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 594.392306][T12177] 8021q: adding VLAN 0 to HW filter on device bond0
[ 594.398634][T12434] bridge0: port 1(bridge_slave_0) entered disabled state
[ 594.402718][T12434] bridge0: port 2(bridge_slave_1) entered disabled state
[ 594.413064][T12177] 8021q: adding VLAN 0 to HW filter on device team0
[ 594.420420][T12442] bridge0: port 1(bridge_slave_0) entered blocking state
[ 594.421466][T12442] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 594.425711][T12434] bridge0: port 2(bridge_slave_1) entered blocking state
[ 594.427210][T12434] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 594.528345][T12177] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 594.648413][T12177] veth0_vlan: entered promiscuous mode
[ 594.651576][T12177] veth1_vlan: entered promiscuous mode
[ 594.661848][T12177] veth0_macvtap: entered promiscuous mode
[ 594.664091][T12177] veth1_macvtap: entered promiscuous mode
[ 594.669943][T12177] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 594.674721][T12177] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 594.677382][T12177] netdevsim netdevsim13 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 594.678479][T12177] netdevsim netdevsim13 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 594.679582][T12177] netdevsim netdevsim13 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 594.680695][T12177] netdevsim netdevsim13 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2024/11/28 03:39:23 executed programs: 0
[ 594.759277][T12190] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 594.770857][T12190] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 594.774868][T12190] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 594.779215][T12190] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 594.782281][T12190] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 594.784949][T12190] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 594.866963][T13554] chnl_net:caif_netlink_parms(): no params data found
[ 594.918913][T13554] bridge0: port 1(bridge_slave_0) entered blocking state
[ 594.919926][T13554] bridge0: port 1(bridge_slave_0) entered disabled state
[ 594.920893][T13554] bridge_slave_0: entered allmulticast mode
[ 594.922756][T13554] bridge_slave_0: entered promiscuous mode
[ 594.925329][T13554] bridge0: port 2(bridge_slave_1) entered blocking state
[ 594.926304][T13554] bridge0: port 2(bridge_slave_1) entered disabled state
[ 594.927256][T13554] bridge_slave_1: entered allmulticast mode
[ 594.928432][T13554] bridge_slave_1: entered promiscuous mode
[ 594.957585][T13554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 594.960541][T13554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 594.996340][T13554] team0: Port device team_slave_0 added
[ 594.998760][T13554] team0: Port device team_slave_1 added
[ 595.029536][T13554] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 595.030519][T13554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be.
[ 595.033616][T13554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 595.036152][T13554] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 595.037043][T13554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be.
[ 595.040407][T13554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 595.071979][T13554] hsr_slave_0: entered promiscuous mode
[ 595.075084][T13554] hsr_slave_1: entered promiscuous mode
[ 595.077101][T13554] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 595.078173][T13554] Cannot create hsr debugfs directory
[ 595.569563][T13554] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 595.572568][T13554] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 595.575589][T13554] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 595.579289][T13554] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 595.618733][T13554] 8021q: adding VLAN 0 to HW filter on device bond0
[ 595.628015][T13554] 8021q: adding VLAN 0 to HW filter on device team0
[ 595.631429][ T3667] bridge0: port 1(bridge_slave_0) entered blocking state
[ 595.633104][ T3667] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 595.639095][T12434] bridge0: port 2(bridge_slave_1) entered blocking state
[ 595.640197][T12434] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 595.757128][T13554] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 595.784957][T13554] veth0_vlan: entered promiscuous mode
[ 595.788190][T13554] veth1_vlan: entered promiscuous mode
[ 595.799383][T13554] veth0_macvtap: entered promiscuous mode
[ 595.801605][T13554] veth1_macvtap: entered promiscuous mode
[ 595.806986][T13554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 595.808207][T13554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 595.809943][T13554] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 595.814881][T13554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 595.816234][T13554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 595.818908][T13554] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 595.821490][T13554] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 595.822491][T13554] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 595.823620][T13554] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 595.824608][T13554] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 595.850812][ T94] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 595.851963][ T94] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 595.863593][ T94] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 595.864674][ T94] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 596.011626][T14593] loop0: detected capacity change from 0 to 32768
[ 596.022942][T14593] ------------[ cut here ]------------
[ 596.023891][T14593] UBSAN: shift-out-of-bounds in fs/jfs/super.c:140:14
[ 596.024715][T14593] shift exponent 50331650 is too large for 64-bit type 'long long int'
[ 596.025671][T14593] CPU: 7 UID: 0 PID: 14593 Comm: syz.0.15 Not tainted 6.12.0-07749-g28eb75e178d3 #1
[ 596.026879][T14593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 596.027913][T14593] Call Trace:
[ 596.028299][T14593] <TASK>
[596.028635][T14593] dump_stack_lvl (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/dump_stack.c:123)
[596.029187][T14593] __ubsan_handle_shift_out_of_bounds (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/ubsan.c:232 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/ubsan.c:468)
[596.029911][T14593] ? selinux_sb_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:1953 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:2752)
[596.030496][T14593] ? __pfx_selinux_sb_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:2746)
[596.031187][T14593] ? putname.part.0 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namei.c:297)
[596.031745][T14593] jfs_statfs.cold (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/jfs/super.c:140 (discriminator 1))
[596.032275][T14593] statfs_by_dentry (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:67)
[596.032838][T14593] user_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:91 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:105)
[596.033364][T14593] ? __pfx_user_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:98)
[596.033926][T14593] ? putname.part.0 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namei.c:297)
[596.034490][T14593] __do_sys_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:194)
[596.035020][T14593] ? __pfx___do_sys_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:191)
[596.035628][T14593] ? __x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:179 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.036188][T14593] ? __x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.036744][T14593] ? __x64_sys_openat (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/open.c:1428)
[596.037320][T14593] ? __pfx___x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.037915][T14593] ? do_syscall_64 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/irqflags.h:42 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/irqflags.h:97 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./include/linux/entry-common.h:198 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:79)
[596.038559][T14593] do_syscall_64 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:52 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:83)
[596.039249][T14593] entry_SYSCALL_64_after_hwframe (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/entry_64.S:130)
[ 596.040138][T14593] RIP: 0033:0x7f6e25f9c62d
[ 596.040779][T14593] Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c8
All code
========
0: 02 b8 ff ff ff ff add -0x1(%rax),%bh
6: c3 ret
7: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
d: f3 0f 1e fa endbr64
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 ret
33: 48 rex.W
34: c8 .byte 0xc8

Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 ret
9: 48 rex.W
a: c8 .byte 0xc8
[ 596.043613][T14593] RSP: 002b:00007f6e251fdf98 EFLAGS: 00000246 ORIG_RAX: 0000000000000089
[ 596.044842][T14593] RAX: ffffffffffffffda RBX: 00007f6e26165f80 RCX: 00007f6e25f9c62d
[ 596.046020][T14593] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
[ 596.047234][T14593] RBP: 00007f6e260264d3 R08: 0000000000000000 R09: 0000000000000000
[ 596.048424][T14593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 596.049603][T14593] R13: 0000000000000000 R14: 00007f6e26165f80 R15: 00007f6e251de000
[ 596.050800][T14593] </TASK>
[ 596.051437][T14593] ---[ end trace ]---
[ 596.052052][T14593] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 596.053129][T14593] CPU: 7 UID: 0 PID: 14593 Comm: syz.0.15 Not tainted 6.12.0-07749-g28eb75e178d3 #1
[ 596.054424][T14593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 596.055484][T14593] Call Trace:
[ 596.055854][T14593] <TASK>
[596.056217][T14593] dump_stack_lvl (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/dump_stack.c:124 (discriminator 7))
[596.056750][T14593] panic (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:354)
[596.057233][T14593] ? __pfx_panic (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:288)
[596.057757][T14593] ? __pfx__printk (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/printk/printk.c:2452)
[596.058344][T14593] ? check_panic_on_warn (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:242)
[596.058934][T14593] check_panic_on_warn (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:243)
[596.059635][T14593] __ubsan_handle_shift_out_of_bounds (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/smap.h:56 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/ubsan.c:470)
[596.060565][T14593] ? selinux_sb_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:1953 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:2752)
[596.061372][T14593] ? __pfx_selinux_sb_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/security/selinux/hooks.c:2746)
[596.062135][T14593] ? putname.part.0 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namei.c:297)
[596.062834][T14593] jfs_statfs.cold (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/jfs/super.c:140 (discriminator 1))
[596.063584][T14593] statfs_by_dentry (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:67)
[596.064279][T14593] user_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:91 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:105)
[596.064880][T14593] ? __pfx_user_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:98)
[596.065637][T14593] ? putname.part.0 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namei.c:297)
[596.066358][T14593] __do_sys_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:194)
[596.067116][T14593] ? __pfx___do_sys_statfs (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/statfs.c:191)
[596.067887][T14593] ? __x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:179 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.068651][T14593] ? __x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.069457][T14593] ? __x64_sys_openat (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/open.c:1428)
[596.070171][T14593] ? __pfx___x64_sys_futex (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/futex/syscalls.c:160)
[596.070965][T14593] ? do_syscall_64 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/irqflags.h:42 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/irqflags.h:97 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./include/linux/entry-common.h:198 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:79)
[596.071712][T14593] do_syscall_64 (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:52 /data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:83)
[596.072308][T14593] entry_SYSCALL_64_after_hwframe (/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/entry_64.S:130)
[ 596.073190][T14593] RIP: 0033:0x7f6e25f9c62d
[ 596.073859][T14593] Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c8
All code
========
0: 02 b8 ff ff ff ff add -0x1(%rax),%bh
6: c3 ret
7: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
d: f3 0f 1e fa endbr64
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 ret
33: 48 rex.W
34: c8 .byte 0xc8

Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 ret
9: 48 rex.W
a: c8 .byte 0xc8
[ 596.076722][T14593] RSP: 002b:00007f6e251fdf98 EFLAGS: 00000246 ORIG_RAX: 0000000000000089
[ 596.077964][T14593] RAX: ffffffffffffffda RBX: 00007f6e26165f80 RCX: 00007f6e25f9c62d
[ 596.079163][T14593] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
[ 596.080348][T14593] RBP: 00007f6e260264d3 R08: 0000000000000000 R09: 0000000000000000
[ 596.081534][T14593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 596.082767][T14593] R13: 0000000000000000 R14: 00007f6e26165f80 R15: 00007f6e251de000
[ 596.083927][T14593] </TASK>
[ 596.084593][T14593] Kernel Offset: disabled

[Aleksandr Nogikh]

Hi Hui Guo,

Please note that Ccing only the syzkall...@googlegroups.com group
is not the best way to reach Linux kernel developers. It's much better
to rely on ./scripts/get_maintainer.pl output (like syzbot does).

--
Aleksandr

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/8a2a3e59-cdf3-4cc9-b5d6-e3ac00b0e366n%40googlegroups.com.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.