Groups
Sign in
Groups
syzkaller-bugs
Conversations
About
Send feedback
Help
[syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbAllocDmapLev
8 views
Skip to first unread message
syzbot
unread,
Dec 23, 2022, 5:23:37 AM
12/23/22
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to jfs-dis...@lists.sourceforge.net, linux-...@vger.kernel.org, mudongl...@gmail.com, paskr...@gmail.com, r33...@gmail.com, sha...@kernel.org, syzkall...@googlegroups.com, wuho...@gmail.com
Hello,
syzbot found the following issue on:
HEAD commit: 0a924817d2ed Merge tag '6.2-rc-smb3-client-fixes-part2' of..
git tree: upstream
console+strace:
https://syzkaller.appspot.com/x/log.txt?x=161140ff880000
kernel config:
https://syzkaller.appspot.com/x/.config?x=4e2d7bfa2d6d5a76
dashboard link:
https://syzkaller.appspot.com/bug?extid=853a6f4dfa3cf37d3aea
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:
https://syzkaller.appspot.com/x/repro.syz?x=14eedba0480000
C reproducer:
https://syzkaller.appspot.com/x/repro.c?x=13760874480000
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/b0959a409a79/disk-0a924817.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/388daa76797b/vmlinux-0a924817.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/b9d2d406c075/bzImage-0a924817.xz
mounted in repro:
https://storage.googleapis.com/syzbot-assets/c5bcb129d7ea/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+853a6f...@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
================================================================================
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1964:6
index -84 is out of range for type 's8 [341]'
CPU: 1 PID: 5074 Comm: syz-executor352 Not tainted 6.1.0-syzkaller-14321-g0a924817d2ed #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_out_of_bounds+0xe0/0x110 lib/ubsan.c:282
dbAllocDmapLev+0x3c6/0x420 fs/jfs/jfs_dmap.c:1964
dbAllocCtl+0x113/0x970 fs/jfs/jfs_dmap.c:1808
dbAllocAG+0x28b/0x1100 fs/jfs/jfs_dmap.c:1349
dbAlloc+0x661/0xc90 fs/jfs/jfs_dmap.c:873
dtSplitUp fs/jfs/jfs_dtree.c:974 [inline]
dtInsert+0xc0e/0x6b80 fs/jfs/jfs_dtree.c:863
jfs_create+0x736/0xb10 fs/jfs/namei.c:137
lookup_open fs/namei.c:3413 [inline]
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x12ac/0x2dd0 fs/namei.c:3711
do_filp_open+0x264/0x4f0 fs/namei.c:3741
do_sys_openat2+0x124/0x4e0 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1337
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fe62a3507c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe095987c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe62a3507c9
RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c
RBP: 00007fe62a310060 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe62a3100f0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
================================================================================
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ
for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com
.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status
for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages