Message-ID: <68fb3947.a70a0220.3bf6c6.015f.GAE@google.com>
Date: Fri, 24 Oct 2025 01:31:03 -0700
From: syzbot <syzbot+77026564530dbc29b854@...kaller.appspotmail.com>
To: dmantipov@...dex.ru, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [ocfs2?] UBSAN: array-index-out-of-bounds in ocfs2_block_group_fill

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

UBSAN: signed-integer-overflow in ip_idents_reserve

================================================================================
UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
-1399202697 + -1961381633 cannot be represented in type 'int'
CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
 dump_stack+0xfd/0x16e lib/dump_stack.c:118
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:148
 handle_overflow+0x192/0x1b0 lib/ubsan.c:180
 arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
 atomic_add_return include/asm-generic/atomic-instrumented.h:73 [inline]
 ip_idents_reserve+0x14a/0x170 net/ipv4/route.c:521
 __ip_select_ident+0xe4/0x1c0 net/ipv4/route.c:538
 iptunnel_xmit+0x468/0x850 net/ipv4/ip_tunnel_core.c:80
 udp_tunnel_xmit_skb+0x1ba/0x290 net/ipv4/udp_tunnel_core.c:190
 send4+0x5d4/0xaf0 drivers/net/wireguard/socket.c:85
 wg_socket_send_skb_to_peer+0xcd/0x1c0 drivers/net/wireguard/socket.c:175
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x16b/0x280 drivers/net/wireguard/send.c:51
 process_one_work+0x85e/0xff0 kernel/workqueue.c:2282
 worker_thread+0xa9b/0x1430 kernel/workqueue.c:2428
 kthread+0x386/0x410 kernel/kthread.c:328
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
================================================================================
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
 dump_stack+0xfd/0x16e lib/dump_stack.c:118
 panic+0x2f0/0x9c0 kernel/panic.c:308
 check_panic_on_warn+0x95/0xe0 kernel/panic.c:228
 handle_overflow+0x192/0x1b0 lib/ubsan.c:180
 arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
 atomic_add_return include/asm-generic/atomic-instrumented.h:73 [inline]
 ip_idents_reserve+0x14a/0x170 net/ipv4/route.c:521
 __ip_select_ident+0xe4/0x1c0 net/ipv4/route.c:538
 iptunnel_xmit+0x468/0x850 net/ipv4/ip_tunnel_core.c:80
 udp_tunnel_xmit_skb+0x1ba/0x290 net/ipv4/udp_tunnel_core.c:190
 send4+0x5d4/0xaf0 drivers/net/wireguard/socket.c:85
 wg_socket_send_skb_to_peer+0xcd/0x1c0 drivers/net/wireguard/socket.c:175
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x16b/0x280 drivers/net/wireguard/send.c:51
 process_one_work+0x85e/0xff0 kernel/workqueue.c:2282
 worker_thread+0xa9b/0x1430 kernel/workqueue.c:2428
 kthread+0x386/0x410 kernel/kthread.c:328
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Kernel Offset: disabled
Rebooting in 86400 seconds..


Warning: Permanently added '10.128.1.176' (ED25519) to the list of known hosts.
2025/10/24 08:30:04 parsed 1 programs
[   48.013663][ T6013] cgroup: Unknown subsys name 'net'
[   48.170944][ T6013] cgroup: Unknown subsys name 'rlimit'
[   49.896812][ T6013] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   50.802412][ T6020] IPVS: ftp: loaded support on port[0] = 21
[   50.981218][ T6026] IPVS: ftp: loaded support on port[0] = 21
[   51.070963][ T6031] IPVS: ftp: loaded support on port[0] = 21
[   51.212304][ T6037] IPVS: ftp: loaded support on port[0] = 21
[   51.298209][ T6042] IPVS: ftp: loaded support on port[0] = 21
[   51.396045][ T6047] IPVS: ftp: loaded support on port[0] = 21
[   51.445463][ T6047] chnl_net:caif_netlink_parms(): no params data found
[   51.483834][ T6047] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.491355][ T6047] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.499426][ T6047] device bridge_slave_0 entered promiscuous mode
[   51.507218][ T6047] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.514361][ T6047] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.521916][ T6047] device bridge_slave_1 entered promiscuous mode
[   51.540701][ T6047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   51.551842][ T6047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   51.567750][ T6047] team0: Port device team_slave_0 added
[   51.574571][ T6047] team0: Port device team_slave_1 added
[   51.586442][ T6047] batman_adv: batadv0: Adding interface: batadv_slave_0
[   51.593515][ T6047] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   51.619504][ T6047] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   51.631289][ T6047] batman_adv: batadv0: Adding interface: batadv_slave_1
[   51.638275][ T6047] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   51.664460][ T6047] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   51.688501][ T6047] device hsr_slave_0 entered promiscuous mode
[   51.695170][ T6047] device hsr_slave_1 entered promiscuous mode
[   51.745737][ T6047] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   51.754100][ T6047] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   51.762823][ T6047] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   51.771249][ T6047] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   51.786410][ T6047] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.793485][ T6047] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.800980][ T6047] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.808073][ T6047] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.835190][ T6047] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.846473][  T178] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   51.855767][  T178] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.863380][  T178] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.871161][  T178] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   51.886989][ T6047] 8021q: adding VLAN 0 to HW filter on device team0
[   51.896287][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   51.904678][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.911755][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.928140][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   51.936459][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.943545][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.951785][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   51.968045][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   51.976221][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   51.986689][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   51.997233][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   52.007405][ T6047] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   52.064410][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   52.072318][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   52.083417][ T6047] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.097534][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   52.116942][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   52.125424][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   52.133639][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   52.144186][ T6047] device veth0_vlan entered promiscuous mode
[   52.158944][ T6047] device veth1_vlan entered promiscuous mode
[   52.173076][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   52.181468][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   52.189866][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   52.205170][ T6047] device veth0_macvtap entered promiscuous mode
[   52.213384][ T6047] device veth1_macvtap entered promiscuous mode
[   52.226086][ T6047] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.233924][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   52.242748][   T27] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   52.257429][ T6047] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.264976][  T178] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   52.275526][ T6047] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.284833][ T6047] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.293537][ T6047] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.302445][ T6047] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.318876][   T27] ================================================================================
[   52.328195][   T27] UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
[   52.336760][   T27] -1399202697 + -1961381633 cannot be represented in type 'int'
[   52.344421][   T27] CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
[   52.351780][   T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   52.361832][   T27] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[   52.368761][   T27] Call Trace:
[   52.372032][   T27]  dump_stack+0xfd/0x16e
[   52.376247][   T27]  ubsan_epilogue+0xa/0x30
[   52.380663][   T27]  handle_overflow+0x192/0x1b0
[   52.385400][   T27]  ? prandom_u32+0x217/0x260
[   52.390240][   T27]  ip_idents_reserve+0x14a/0x170
[   52.395164][   T27]  __ip_select_ident+0xe4/0x1c0
[   52.400000][   T27]  iptunnel_xmit+0x468/0x850
[   52.404585][   T27]  udp_tunnel_xmit_skb+0x1ba/0x290
[   52.409691][   T27]  send4+0x5d4/0xaf0
[   52.413573][   T27]  wg_socket_send_skb_to_peer+0xcd/0x1c0
[   52.419181][   T27]  wg_packet_handshake_send_worker+0x16b/0x280
[   52.425312][   T27]  process_one_work+0x85e/0xff0
[   52.430173][   T27]  worker_thread+0xa9b/0x1430
[   52.434940][   T27]  ? rcu_lock_release+0x20/0x20
[   52.439765][   T27]  kthread+0x386/0x410
[   52.443809][   T27]  ? rcu_lock_release+0x20/0x20
[   52.448664][   T27]  ? kthread_blkcg+0xd0/0xd0
[   52.453322][   T27]  ret_from_fork+0x1f/0x30
[   52.457765][   T27] ================================================================================
[   52.467065][   T27] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[   52.474261][   T27] CPU: 1 PID: 27 Comm: kworker/u4:2 Not tainted syzkaller #0
[   52.481603][   T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   52.491670][   T27] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
[   52.498580][   T27] Call Trace:
[   52.501854][   T27]  dump_stack+0xfd/0x16e
[   52.506080][   T27]  panic+0x2f0/0x9c0
[   52.509954][   T27]  check_panic_on_warn+0x95/0xe0
[   52.514870][   T27]  handle_overflow+0x192/0x1b0
[   52.519633][   T27]  ? prandom_u32+0x217/0x260
[   52.524228][   T27]  ip_idents_reserve+0x14a/0x170
[   52.529235][   T27]  __ip_select_ident+0xe4/0x1c0
[   52.534066][   T27]  iptunnel_xmit+0x468/0x850
[   52.538633][   T27]  udp_tunnel_xmit_skb+0x1ba/0x290
[   52.543721][   T27]  send4+0x5d4/0xaf0
[   52.547604][   T27]  wg_socket_send_skb_to_peer+0xcd/0x1c0
[   52.553417][   T27]  wg_packet_handshake_send_worker+0x16b/0x280
[   52.559562][   T27]  process_one_work+0x85e/0xff0
[   52.564387][   T27]  worker_thread+0xa9b/0x1430
[   52.569136][   T27]  ? rcu_lock_release+0x20/0x20
[   52.574052][   T27]  kthread+0x386/0x410
[   52.578096][   T27]  ? rcu_lock_release+0x20/0x20
[   52.582913][   T27]  ? kthread_blkcg+0xd0/0xd0
[   52.587475][   T27]  ret_from_fork+0x1f/0x30
[   52.592191][   T27] Kernel Offset: disabled
[   52.596510][   T27] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1315598195=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at b6605ba8b96
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=b6605ba8b96835063c5eb766c38d27fac98b84d4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251013-102005"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=b6605ba8b96835063c5eb766c38d27fac98b84d4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251013-102005"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=b6605ba8b96835063c5eb766c38d27fac98b84d4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251013-102005"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"b6605ba8b96835063c5eb766c38d27fac98b84d4\"
/usr/bin/ld: /tmp/cccF2O1E.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         d3d0b4e2 Linux 5.10.245
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-5.10.y
kernel config:  https://syzkaller.appspot.com/x/.config?x=6e4052b2d7feb092
dashboard link: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16982d2f980000

Powered by blists - more mailing lists