syzbot

 sign-in | mailing list | source | docs
🐞 Open [1592]
≡ Subsystems
🐞 Fixed [6233]
🐞 Invalid [15779]
⬇ Missing Backports [183]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update

Status: upstream: reported C repro on 2025/04/28 17:04
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+14c52d86ddbd89bea13e@syzkaller.appspotmail.com
First crash: 22d, last: 3h34m
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update 0 (1) 2025/04/28 17:04

Sample crash report:
bcachefs (loop0): bucket 0:26 gen 0 data type btree sector count overflow: 0 + -256 > U32_MAX
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/bcachefs/sb-downgrade.c:268:4
index 0 is out of range for type '__le16[] __counted_by(nr_errors)' (aka 'unsigned short[]')
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:6 Not tainted 6.15.0-rc3-syzkaller-00076-ge72e9e693307 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
 panic+0x2db/0x790 kernel/panic.c:354
 check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
 downgrade_table_extra fs/bcachefs/sb-downgrade.c:268 [inline]
 bch2_sb_downgrade_update+0xb10/0xcc0 fs/bcachefs/sb-downgrade.c:388
 bch2_write_super+0xbf4/0x2cc0 fs/bcachefs/super-io.c:1071
 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:608 [inline]
 btree_update_nodes_written fs/bcachefs/btree_update_interior.c:678 [inline]
 btree_interior_update_work+0x441/0x25e0 fs/bcachefs/btree_update_interior.c:843
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (250):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/24 19:38 upstream e72e9e693307 9c80ffa0 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/17 01:45 upstream 3c21441eeffc cfde8269 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/16 23:24 upstream 3c21441eeffc cfde8269 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/09 06:03 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 22:48 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 20:03 upstream 2c89c1b655c0 bb813bcc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 13:43 upstream d76bb1ebb558 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 11:15 upstream d76bb1ebb558 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 08:16 upstream d76bb1ebb558 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 06:53 upstream d76bb1ebb558 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/08 03:28 upstream 707df3375124 dbf35fa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 11:47 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 09:38 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 05:57 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 03:43 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 02:24 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/07 00:20 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/06 19:31 upstream 0d8d44db295c 350f4ffc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/06 11:03 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/06 08:25 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/06 03:18 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/05 22:38 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/05 00:04 upstream e8ab83e34bdc b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/04 18:38 upstream e8ab83e34bdc b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/04 13:06 upstream 2a239ffbebb5 b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/04 12:03 upstream 2a239ffbebb5 b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/04 02:13 upstream 2a239ffbebb5 b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/03 18:06 upstream 95d3481af6dc b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/03 12:42 upstream 95d3481af6dc b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/03 09:51 upstream 00b827f0cffa b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/03 06:56 upstream 00b827f0cffa b0714e37 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 18:47 upstream ebd297a2affa d7f099d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 17:19 upstream ebd297a2affa d7f099d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 16:10 upstream ebd297a2affa d7f099d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 14:16 upstream ebd297a2affa d7f099d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 11:01 upstream ebd297a2affa d7f099d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/02 01:14 upstream 4f79eaa2ceac 51b137cd .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/01 23:12 upstream 4f79eaa2ceac 51b137cd .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/01 20:59 upstream 4f79eaa2ceac 51b137cd .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/01 12:36 upstream 7a13c14ee59d ce7952f4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/01 11:27 upstream 7a13c14ee59d ce7952f4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/05/01 05:29 upstream 7a13c14ee59d ce7952f4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/04/30 23:19 upstream b6ea1680d0ac 937aafd7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/04/30 19:15 upstream b6ea1680d0ac 937aafd7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/04/30 17:09 upstream b6ea1680d0ac 937aafd7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/04/30 15:57 upstream b6ea1680d0ac 937aafd7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
2025/04/30 03:59 upstream 8bac8898fe39 85a5a23f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update
* Struck through repros no longer work on HEAD.