[BUG] jfs: UBSAN shift-out-of-bounds in dbSplit

[CJ <firefly0158@163.com>]

Hi,


I am reporting a UBSAN shift-out-of-bounds in the JFS dmap split path, triggered
by a syzkaller reproducer that mounts a crafted JFS image.  The issue is
reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935
(v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and
allocates blocks, which makes the allocator split a dmap control page.


UBSAN reports a shift-out-of-bounds at fs/jfs/jfs_dmap.c:2728 with a shift
exponent of 121, which is far beyond the width of the 32-bit int being shifted.
The call path is dbSplit -> dbAllocBits -> dbAllocDmap -> dbAllocDmapLev.  In the
original report the same report was recorded at fs/jfs/jfs_dmap.c:2707 with the
same shift exponent, so only the source line has moved.


One possible cause is that a value read from the dmap control page in the crafted
image is used as a shift amount without a range check, so the shift is undefined.
This looks like a missing validation of an on-disk field used in an arithmetic
expression.  I am reporting the sanitizer finding and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
eac84ce8b38992ca3441.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/K41rvWi8

console output: https://pastebin.com/raw/pUcm7xJB

kernel config: https://pastebin.com/raw/DmudbVCf


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian