UBSAN: array-index-out-of-bounds in do_journal_end

[yshigeru]

================================================================================                                                                           
UBSAN: array-index-out-of-bounds in fs/reiserfs/journal.c:4166:22                                                                                          
index 1 is out of range for type '__le32 [1]'                                                                                                              
CPU: 0 PID: 8597 Comm: syz-executor.1 Not tainted 6.5.0-rc5 #2                                                                                             
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014                                                                       
Call Trace:                                                                                                                                                
 <TASK>                                                                                                                                                    
 __dump_stack lib/dump_stack.c:88 [inline]                                                                                                                 
 dump_stack_lvl+0x11d/0x1b0 lib/dump_stack.c:106                                                                                                           
 ubsan_epilogue+0xa/0x40 lib/ubsan.c:217                                                                                                                   
 __ubsan_handle_out_of_bounds+0xa4/0xb6 lib/ubsan.c:348                                                                                                    
 do_journal_end+0x3ea4/0x4c20 fs/reiserfs/journal.c:4166                                                                                                   
 reiserfs_sync_fs+0x10e/0x140 fs/reiserfs/super.c:78                                                                                                       
 sync_filesystem fs/sync.c:56 [inline]                                                                                                                     
 sync_filesystem+0x109/0x280 fs/sync.c:30                                                                                                                  
 generic_shutdown_super+0x74/0x480 fs/super.c:472                                                                                                          
 kill_block_super+0x64/0xb0 fs/super.c:1417                                                                                                                
 deactivate_locked_super+0x9a/0x170 fs/super.c:330                                                                                                         
 deactivate_super+0xe2/0x100 fs/super.c:361                                                                                                                
 cleanup_mnt+0x225/0x3e0 fs/namespace.c:1254                                                                                                               
 task_work_run+0x14d/0x240 kernel/task_work.c:179                                                                                                          
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]                                                                                        
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]                                                                                                 
 exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204                                                                                           
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]                                                                                       
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297                                                                                             
 do_syscall_64+0x45/0xb0 arch/x86/entry/common.c:86                                                                                                        
 entry_SYSCALL_64_after_hwframe+0x63/0xcd                                                                                                                  
RIP: 0033:0x45afcb                                                                                                                                         
Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 90 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77\
 05 c3 0f 1f 40 00 48 c7 c2 b0 ff ff ff f7 d8                                                                                                              
RSP: 002b:00007ffedb117e38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6                                                                                     
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000045afcb                                                                                          
RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffedb117ee0                                                                                          
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000                                                                                          
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffedb118f90                                                                                          
R13: 00000000010cc850 R14: 0000000000000000 R15: 0000000000000001                                                                                          
 </TASK>                                                                                                                                                   
================================================================================                                                                           

[yshigeru]

repro.cprog.gz

[yshigeru]

類似事象：pid: Replace struct pid 1-element array with flex-array

[yshigeru]

0001-reiserfs-Replace-1-element-array-with-C99-style-flex.patch.gz

[yshigeru]

Sent the patch: https://lore.kernel.org/all/20230821043312.1444068-1-syoshida@redhat.com/

[yshigeru]

Applied: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git/commit/?h=vfs.misc&id=da2ed4f5067f7d7766d3c8490e3ec52b8c20a51b