syzbot

loop0: detected capacity change from 0 to 32768
==================================================================
BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753
Write of size 32 at addr ffff0000cb90a0c0 by task syz-executor209/4292

CPU: 1 PID: 4292 Comm: syz-executor209 Not tainted 6.1.128-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x174/0x4c0 mm/kasan/report.c:427
 kasan_report+0xd4/0x130 mm/kasan/report.c:531
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
 memcpy+0x60/0x90 mm/kasan/shadow.c:66
 diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753
 txCommit+0x750/0x5574 fs/jfs/jfs_txnmgr.c:1255
 add_missing_indices+0x760/0xa8c fs/jfs/jfs_dtree.c:2663
 jfs_readdir+0x18ac/0x3030 fs/jfs/jfs_dtree.c:3019
 iterate_dir+0x1f4/0x4ec
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x1c4/0x4a0 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4291:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x458 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x230/0x37c mm/slub.c:3422
 vm_area_alloc+0x2c/0xe0 kernel/fork.c:459
 __mmap_region mm/mmap.c:2741 [inline]
 mmap_region+0x1118/0x2208 mm/mmap.c:2904
 do_mmap+0x9ac/0x110c mm/mmap.c:1424
 vm_mmap_pgoff+0x1a4/0x2b4 mm/util.c:520
 vm_mmap+0x90/0xbc mm/util.c:539
 elf_map+0xec/0x220 fs/binfmt_elf.c:390
 load_elf_binary+0xc98/0x1d98 fs/binfmt_elf.c:1167
 search_binary_handler fs/exec.c:1741 [inline]
 exec_binprm fs/exec.c:1782 [inline]
 bprm_execve+0x818/0x162c fs/exec.c:1851
 do_execveat_common+0x668/0x814 fs/exec.c:1956
 do_execve fs/exec.c:2030 [inline]
 __do_sys_execve fs/exec.c:2106 [inline]
 __se_sys_execve fs/exec.c:2101 [inline]
 __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 4291:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x2f0/0x588 mm/slub.c:3683
 vm_area_free+0x58/0x12c kernel/fork.c:486
 remove_vma mm/mmap.c:143 [inline]
 exit_mmap+0x40c/0xa0c mm/mmap.c:3260
 __mmput+0xec/0x39c kernel/fork.c:1200
 mmput+0x70/0xac kernel/fork.c:1222
 exec_mmap+0x404/0x484 fs/exec.c:1040
 begin_new_exec+0x6c8/0xf04 fs/exec.c:1299
 load_elf_binary+0x748/0x1d98 fs/binfmt_elf.c:1002
 search_binary_handler fs/exec.c:1741 [inline]
 exec_binprm fs/exec.c:1782 [inline]
 bprm_execve+0x818/0x162c fs/exec.c:1851
 do_execveat_common+0x668/0x814 fs/exec.c:1956
 do_execve fs/exec.c:2030 [inline]
 __do_sys_execve fs/exec.c:2106 [inline]
 __se_sys_execve fs/exec.c:2101 [inline]
 __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000cb90a000
 which belongs to the cache vm_area_struct of size 152
The buggy address is located 40 bytes to the right of
 152-byte region [ffff0000cb90a000, ffff0000cb90a098)

The buggy address belongs to the physical page:
page:0000000010b2216d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b90a
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0851680
raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cb909f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000cb90a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000cb90a080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
                                           ^
 ffff0000cb90a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff0000cb90a180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
==================================================================
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0

ERROR: (device loop0): remounting filesystem as read-only