UBSAN: array-index-out-of-bounds in decompress

ID	Workflow	Correct	Bug	Created	Started	Finished	Revision	Error
9739a353-f4ee-489d-8619-ec1486bfc69c	assessment-security	💥	UBSAN: array-index-out-of-bounds in decompress_lznt	2026/06/18 00:17	2026/06/18 00:17	2026/06/18 00:41	b62b3ded1759f79b37600c5ffe2b0a81b919b0b0	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/22b2b3f29046598a15... truncated to first 200 bytes; open job for full error
33f2b557-c9ad-4b35-b6d6-1f247b7dfcb3	assessment-security	💥	UBSAN: array-index-out-of-bounds in decompress_lznt	2026/06/09 19:50	2026/06/09 19:50	2026/06/09 20:16	c36c07f6c1f2230a36374cbd22235f635e8f9284	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/22b2b3f29046598a15... truncated to first 200 bytes; open job for full error
db8bd237-3441-4cbf-992d-427d2fd3350d	assessment-security	💥	UBSAN: array-index-out-of-bounds in decompress_lznt	2026/06/02 20:12	2026/06/02 20:12	2026/06/02 20:36	62fe15281f5011cd203d8845b8767b10e7443aa5	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/22b2b3f29046598a15... truncated to first 200 bytes; open job for full error
da8e5c54-7754-4ad0-af42-f33fe37bacf5	assessment-security	💥	UBSAN: array-index-out-of-bounds in decompress_lznt	2026/05/30 04:07	2026/05/30 04:07	2026/05/30 04:34	6b4a844333e83556da95d61d7f207e7ef5cd4bc6	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/22b2b3f29046598a15... truncated to first 200 bytes; open job for full error
5ebf19dd-27fa-45da-bff3-43737a636403	assessment-security	💥	UBSAN: array-index-out-of-bounds in decompress_lznt	2026/05/13 04:05	2026/05/13 04:05	2026/05/13 04:35	ac1aeadbb84e4988133fcdf26ca80803a538fe09	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/22b2b3f29046598a15... truncated to first 200 bytes; open job for full error

Title	Replies (including bot)	Last reply
[PATCH] ntfs3: fix out-of-bounds read in decompress_lznt	2 (2)	2026/04/30 12:00
[syzbot] [ntfs3?] UBSAN: array-index-out-of-bounds in decompress_lznt	0 (5)	2026/04/17 16:20
[PATCH] ntfs3: check if more than chunk-size bytes are written	1 (2)	2024/05/15 12:59

Title

Replies (including bot)

Last reply

[PATCH] ntfs3: fix out-of-bounds read in decompress_lznt

2 (2)

2026/04/30 12:00

[syzbot] [ntfs3?] UBSAN: array-index-out-of-bounds in decompress_lznt

0 (5)

2026/04/17 16:20

[PATCH] ntfs3: check if more than chunk-size bytes are written

1 (2)

2024/05/15 12:59

Created	Duration	User	Patch	Repo	Result
2026/04/17 16:20	14m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/04/17 10:12	13m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/02/25 01:13	53m	retest repro		upstream	report log
2025/12/16 22:09	32m	retest repro		upstream	report log
2025/10/07 03:04	16m	retest repro		upstream	report log
2025/07/27 20:41	13m	retest repro		upstream	report log
2025/05/18 18:01	16m	retest repro		upstream	report log
2025/03/08 18:00	13m	retest repro		upstream	report log
2024/12/28 16:06	14m	retest repro		upstream	report log
2024/08/23 16:04	14m	almaz.alexandrovich@paragon-software.com		https://github.com/Paragon-Software-Group/linux-ntfs3.git master	report log
2024/07/01 21:55	11m	mukattreyee@gmail.com		https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2024/05/25 02:23	11m	retest repro		upstream	report log
2024/05/15 12:40	17m	andrewjballance@gmail.com	patch	upstream	OK log

Created

Duration

User

Patch

Repo

Result

2026/04/17 16:20

14m

tristmd@gmail.com

patch

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

report log

2026/04/17 10:12

13m

tristmd@gmail.com

patch

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

report log

2026/02/25 01:13

53m

retest repro

upstream

report log

2025/12/16 22:09

32m

retest repro

upstream

report log

2025/10/07 03:04

16m

retest repro

upstream

report log

2025/07/27 20:41

13m

retest repro

upstream

report log

2025/05/18 18:01

16m

retest repro

upstream

report log

2025/03/08 18:00

13m

retest repro

upstream

report log

2024/12/28 16:06

14m

retest repro

upstream

report log

2024/08/23 16:04

14m

almaz.alexandrovich@paragon-software.com

https://github.com/Paragon-Software-Group/linux-ntfs3.git master

report log

2024/07/01 21:55

11m

mukattreyee@gmail.com

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

report log

2024/05/25 02:23

11m

retest repro

upstream

report log

2024/05/15 12:40

17m

andrewjballance@gmail.com

patch

upstream

OK log

Created	Duration	User	Repo	Result
2024/10/15 02:04	0m	bisect fix	upstream	error job log
2024/09/12 15:49	2h15m	bisect fix	upstream	OK (0) job log log
2024/08/10 20:02	1h14m	bisect fix	upstream	OK (0) job log log
2024/06/29 15:14	1h07m	bisect fix	upstream	OK (0) job log log

Created

Duration

User

Patch

Repo

Result

2024/10/15 02:04

bisect fix

upstream

error job log

2024/09/12 15:49

2h15m

bisect fix

upstream

OK (0) job log log

2024/08/10 20:02

1h14m

bisect fix

upstream

OK (0) job log log

2024/06/29 15:14

1h07m

bisect fix

upstream

OK (0) job log log

------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/ntfs3/lznt.c:240:16 index 9 is out of range for type 'const size_t[9]' (aka 'const unsigned long[9]') CPU: 1 PID: 5072 Comm: syz-executor335 Not tainted 6.9.0-rc7-syzkaller-00136-gf4345f05c0df #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429 decompress_chunk fs/ntfs3/lznt.c:240 [inline] decompress_lznt+0x229/0xd50 fs/ntfs3/lznt.c:387 ni_read_frame+0x1633/0x1c50 fs/ntfs3/frecord.c:2684 ni_readpage_cmpr+0x38b/0xa60 fs/ntfs3/frecord.c:2143 ntfs_read_folio+0x19e/0x210 fs/ntfs3/inode.c:725 filemap_read_folio+0x1a0/0x790 mm/filemap.c:2331 filemap_update_page mm/filemap.c:2415 [inline] filemap_get_pages+0x15a9/0x2090 mm/filemap.c:2529 filemap_read+0x457/0xfa0 mm/filemap.c:2601 __kernel_read+0x5c8/0xab0 fs/read_write.c:434 integrity_kernel_read+0xb0/0x100 security/integrity/iint.c:28 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline] ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline] ima_calc_file_hash+0xadb/0x1b30 security/integrity/ima/ima_crypto.c:573 ima_collect_measurement+0x535/0xa90 security/integrity/ima/ima_api.c:291 process_measurement+0x13ac/0x1f60 security/integrity/ima/ima_main.c:359 ima_file_check+0xf2/0x170 security/integrity/ima/ima_main.c:559 security_file_post_open+0x6d/0xa0 security/security.c:2981 do_open fs/namei.c:3644 [inline] path_openat+0x28b7/0x3240 fs/namei.c:3799 do_filp_open+0x235/0x490 fs/namei.c:3826 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 do_sys_open fs/open.c:1421 [inline] __do_sys_open fs/open.c:1429 [inline] __se_sys_open fs/open.c:1425 [inline] __x64_sys_open+0x225/0x270 fs/open.c:1425 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbd0c2059b9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffa3c72cd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fffa3c72ea8 RCX: 00007fbd0c2059b9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007fbd0c298610 R08: 00007fffa3c72ea8 R09: 00007fffa3c72ea8 R10: 00007fffa3c72ea8 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fffa3c72e98 R14: 0000000000000001 R15: 0000000000000001 </TASK> ---[ end trace ]---

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/05/11 01:53	upstream	f4345f05c0df	f7c35481	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2]	ci2-upstream-fs	UBSAN: array-index-out-of-bounds in decompress_lznt
2024/05/11 01:31	upstream	f4345f05c0df	f7c35481	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	UBSAN: array-index-out-of-bounds in decompress_lznt

Crashes (2):

Assets (help?)