Re: [syzbot] [block?] UBSAN: shift-out-of-bounds in null_process_zoned_cmd

[Niklas Cassel]

On Thu, Aug 13, 2026 at 05:10:31AM -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1767f479580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> dashboard link: https://syzkaller.appspot.com/bug?extid=abd6a8dca0f2b7726060
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16038ac6580000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+abd6a8dca0f2b7726060@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> ------------[ cut here ]------------
> UBSAN: shift-out-of-bounds in drivers/block/null_blk/zoned.c:21:14
> shift exponent -1 is negative
> CPU: 0 UID: 0 PID: 6032 Comm: syz-executor192 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
>  ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
>  __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
>  null_zone_no drivers/block/null_blk/zoned.c:21 [inline]

line 21:
return sect >> ilog2(dev->zone_size_sects);

ilog2() only return -1 when being supplied 0.

dev->zone_size_sects can only be 0 while dev->zoned == true,
if syzbot changed zone_size concurrently as null_add_dev() was
called.

Otherwise, the zone_size == 0 checks in null_validate_conf() and
null_init_zoned_dev() and blk_revalidate_disk_zones() would all have
returned an error.


So this suggests that it is the same problem as is solved by:
https://lore.kernel.org/linux-block/44c18098-a4ca-4c72-863e-9109251e965c@xxxxxxxxxx/T/#t

Just that syzbot modified the 'zone_size' configfs attribute
concurrently as null_add_dev(), rather than 'zoned'.


Kind regards,
Niklas