[BUG] befs: UBSAN shift-out-of-bounds in befs_check_sb

[CJ <firefly0158@163.com>]

Hi,


I am reporting a UBSAN shift-out-of-bounds during befs mount, triggered by a
syzkaller reproducer that mounts a crafted befs image.  The issue is reproducible
with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux
7.3.0-rc1).


The reproducer mounts a crafted befs filesystem image on a loop device; the
console shows loop0 detected with a capacity of 128 blocks and then the
sanitizer report from the mount path.


UBSAN reports a shift-out-of-bounds at fs/befs/super.c:96:9 with a shift exponent
of 2066842816, which is far outside the width of the 32-bit int being shifted.
The call path is befs_check_sb, reached from befs_fill_super.  One detail worth
noting for anyone reproducing this: in the console captured on v7.3-rc1 the
report's file path is printed as a kernel build directory path rather than
fs/befs/super.c, because the test kernel was built with its source tree in a
different location; the source line and column (super.c:96:9) are the same as in
the original report.


One possible cause is that a superblock field read from the crafted image is used
as a shift amount without being range-checked, so the shift is undefined.  This
looks like a missing validation of an on-disk field.  I am reporting the
sanitizer finding and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
affd78fff833c2695d02.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/ST4qEfkS

console output: https://pastebin.com/raw/y4dK6p7e

kernel config:  https://pastebin.com/raw/vwQnQM1r


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian