linux-kernel - Re: [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in shmem_add_to_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250205103421.1895-1-hdanton@sina.com>
Date: Wed,  5 Feb 2025 18:34:20 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+07392c132f11b1758ac3@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in shmem_add_to_page_cache

On Tue, 04 Feb 2025 07:34:26 -0800
> syzbot found the following issue on:
> 
> HEAD commit:    69e858e0b8b2 Merge tag 'uml-for-linus-6.14-rc1' of git://g..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=160983df980000

#syz test upstream  master

--- x/lib/xarray.c
+++ y/lib/xarray.c
@@ -390,6 +390,7 @@ static void *xas_alloc(struct xa_state *
 	XA_NODE_BUG_ON(node, shift > BITS_PER_LONG);
 	XA_NODE_BUG_ON(node, !list_empty(&node->private_list));
 	node->shift = shift;
+	BUG_ON(shift > BITS_PER_LONG);
 	node->count = 0;
 	node->nr_values = 0;
 	RCU_INIT_POINTER(node->parent, xas->xa_node);
--