Warning: Permanently added '10.128.0.55' (ED25519) to the list of known hosts. executing program [ 33.564865][ T6163] loop0: detected capacity change from 0 to 32768 [ 33.578527][ T6163] ------------[ cut here ]------------ [ 33.580007][ T6163] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 33.582102][ T6163] index -1 is out of range for type 'struct dtslot[128]' [ 33.583910][ T6163] CPU: 0 PID: 6163 Comm: syz-executor257 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.586503][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.589152][ T6163] Call trace: [ 33.590059][ T6163] dump_backtrace+0x1b8/0x1e4 [ 33.591260][ T6163] show_stack+0x2c/0x3c [ 33.592320][ T6163] dump_stack_lvl+0xd0/0x124 [ 33.593530][ T6163] dump_stack+0x1c/0x28 [ 33.594590][ T6163] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.596075][ T6163] jfs_readdir+0x1580/0x37bc [ 33.597289][ T6163] wrap_directory_iterator+0xa8/0xf4 [ 33.598721][ T6163] shared_jfs_readdir+0x30/0x40 [ 33.599985][ T6163] iterate_dir+0x3f8/0x580 [ 33.601137][ T6163] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.602584][ T6163] invoke_syscall+0x98/0x2b8 [ 33.603808][ T6163] el0_svc_common+0x130/0x23c [ 33.605010][ T6163] do_el0_svc+0x48/0x58 [ 33.606118][ T6163] el0_svc+0x54/0x168 [ 33.607137][ T6163] el0t_64_sync_handler+0x84/0xfc [ 33.608380][ T6163] el0t_64_sync+0x190/0x194 [ 33.611046][ T6163] ---[ end trace ]--- [ 33.612126][ T6163] ------------[ cut here ]------------ [ 33.613509][ T6163] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 33.615870][ T6163] index -1 is out of range for type 'struct dtslot[128]' [ 33.617735][ T6163] CPU: 0 PID: 6163 Comm: syz-executor257 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.620321][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.622925][ T6163] Call trace: [ 33.623742][ T6163] dump_backtrace+0x1b8/0x1e4 [ 33.625031][ T6163] show_stack+0x2c/0x3c [ 33.626115][ T6163] dump_stack_lvl+0xd0/0x124 [ 33.627318][ T6163] dump_stack+0x1c/0x28 [ 33.628398][ T6163] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.629922][ T6163] jfs_readdir+0x1dfc/0x37bc [ 33.631132][ T6163] wrap_directory_iterator+0xa8/0xf4 [ 33.632529][ T6163] shared_jfs_readdir+0x30/0x40 [ 33.633827][ T6163] iterate_dir+0x3f8/0x580 [ 33.635000][ T6163] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.636408][ T6163] invoke_syscall+0x98/0x2b8 [ 33.637647][ T6163] el0_svc_common+0x130/0x23c [ 33.638919][ T6163] do_el0_svc+0x48/0x58 [ 33.639958][ T6163] el0_svc+0x54/0x168 [ 33.641046][ T6163] el0t_64_sync_handler+0x84/0xfc [ 33.642401][ T6163] el0t_64_sync+0x190/0x194 [ 33.644174][ T6163] ---[ end trace ]--- [ 33.645313][ T6163] ------------[ cut here ]------------ [ 33.646731][ T6163] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 33.648692][ T6163] index 255 is out of range for type 'struct dtslot[128]' [ 33.650523][ T6163] CPU: 0 PID: 6163 Comm: syz-executor257 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.653063][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.655752][ T6163] Call trace: [ 33.656702][ T6163] dump_backtrace+0x1b8/0x1e4 [ 33.657923][ T6163] show_stack+0x2c/0x3c [ 33.659014][ T6163] dump_stack_lvl+0xd0/0x124 [ 33.660214][ T6163] dump_stack+0x1c/0x28 [ 33.661336][ T6163] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.662882][ T6163] diWrite+0xbcc/0x15cc [ 33.663945][ T6163] txCommit+0x750/0x5438 [ 33.665049][ T6163] jfs_readdir+0x1e80/0x37bc [ 33.666276][ T6163] wrap_directory_iterator+0xa8/0xf4 [ 33.667730][ T6163] shared_jfs_readdir+0x30/0x40 [ 33.669082][ T6163] iterate_dir+0x3f8/0x580 [ 33.670270][ T6163] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.671699][ T6163] invoke_syscall+0x98/0x2b8 [ 33.672903][ T6163] el0_svc_common+0x130/0x23c [ 33.674135][ T6163] do_el0_svc+0x48/0x58 [ 33.675231][ T6163] el0_svc+0x54/0x168 [ 33.676281][ T6163] el0t_64_sync_handler+0x84/0xfc [ 33.677615][ T6163] el0t_64_sync+0x190/0x194 [ 33.678950][ T6163] ---[ end trace ]--- [ 33.680096][ T6163] ------------[ cut here ]------------ [ 33.681524][ T6163] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 33.683513][ T6163] index 255 is out of range for type 'struct dtslot[128]' [ 33.685394][ T6163] CPU: 0 PID: 6163 Comm: syz-executor257 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.687891][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.690489][ T6163] Call trace: [ 33.691307][ T6163] dump_backtrace+0x1b8/0x1e4 [ 33.692526][ T6163] show_stack+0x2c/0x3c [ 33.693595][ T6163] dump_stack_lvl+0xd0/0x124 [ 33.694798][ T6163] dump_stack+0x1c/0x28 [ 33.695908][ T6163] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.697452][ T6163] diWrite+0xc24/0x15cc [ 33.698549][ T6163] txCommit+0x750/0x5438 [ 33.699623][ T6163] jfs_readdir+0x1e80/0x37bc [ 33.700840][ T6163] wrap_directory_iterator+0xa8/0xf4 [ 33.702288][ T6163] shared_jfs_readdir+0x30/0x40 [ 33.703571][ T6163] iterate_dir+0x3f8/0x580 [ 33.704700][ T6163] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.706133][ T6163] invoke_syscall+0x98/0x2b8 [ 33.707303][ T6163] el0_svc_common+0x130/0x23c [ 33.708545][ T6163] do_el0_svc+0x48/0x58 [ 33.709632][ T6163] el0_svc+0x54/0x168 [ 33.710665][ T6163] el0t_64_sync_handler+0x84/0xfc [ 33.711998][ T6163] el0t_64_sync+0x190/0x194 [ 33.713242][ T6163] ---[ end trace ]--- [ 33.714415][ T6163] ================================================================== [ 33.716455][ T6163] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 33.718339][ T6163] Read of size 32 at addr ffff0000dbb8d110 by task syz-executor257/6163 [ 33.720479][ T6163] [ 33.721052][ T6163] CPU: 0 PID: 6163 Comm: syz-executor257 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.723682][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.726520][ T6163] Call trace: [ 33.727375][ T6163] dump_backtrace+0x1b8/0x1e4 [ 33.728577][ T6163] show_stack+0x2c/0x3c [ 33.729655][ T6163] dump_stack_lvl+0xd0/0x124 [ 33.730931][ T6163] print_report+0x178/0x518 [ 33.732128][ T6163] kasan_report+0xd8/0x138 [ 33.733280][ T6163] kasan_check_range+0x254/0x294 [ 33.734517][ T6163] __asan_memcpy+0x3c/0x84 [ 33.735664][ T6163] diWrite+0xb48/0x15cc [ 33.736753][ T6163] txCommit+0x750/0x5438 [ 33.737871][ T6163] jfs_readdir+0x1e80/0x37bc [ 33.739075][ T6163] wrap_directory_iterator+0xa8/0xf4 [ 33.740473][ T6163] shared_jfs_readdir+0x30/0x40 [ 33.741808][ T6163] iterate_dir+0x3f8/0x580 [ 33.742991][ T6163] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.744401][ T6163] invoke_syscall+0x98/0x2b8 [ 33.745577][ T6163] el0_svc_common+0x130/0x23c [ 33.746751][ T6163] do_el0_svc+0x48/0x58 [ 33.747833][ T6163] el0_svc+0x54/0x168 [ 33.748822][ T6163] el0t_64_sync_handler+0x84/0xfc [ 33.750136][ T6163] el0t_64_sync+0x190/0x194 [ 33.751290][ T6163] [ 33.751893][ T6163] The buggy address belongs to the object at ffff0000dbb8ca00 [ 33.751893][ T6163] which belongs to the cache jfs_ip of size 2240 [ 33.755528][ T6163] The buggy address is located 1808 bytes inside of [ 33.755528][ T6163] allocated 2240-byte region [ffff0000dbb8ca00, ffff0000dbb8d2c0) [ 33.759238][ T6163] [ 33.759879][ T6163] The buggy address belongs to the physical page: [ 33.761333][ T6163] page:00000000061078da refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bb88 [ 33.763821][ T6163] head:00000000061078da order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.766178][ T6163] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 33.768233][ T6163] page_type: 0xffffffff() [ 33.769353][ T6163] raw: 05ffc00000000840 ffff0000c471b3c0 dead000000000122 0000000000000000 [ 33.771579][ T6163] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 33.773790][ T6163] page dumped because: kasan: bad access detected [ 33.775401][ T6163] [ 33.776019][ T6163] Memory state around the buggy address: [ 33.777455][ T6163] ffff0000dbb8d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.779654][ T6163] ffff0000dbb8d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.781773][ T6163] >ffff0000dbb8d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.783926][ T6163] ^ [ 33.785129][ T6163] ffff0000dbb8d180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.787281][ T6163] ffff0000dbb8d200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.789403][ T6163] ================================================================== [ 33.791651][ T6163] Disabling lock debugging due to kernel taint [ 33.793369][ T6163] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 33.793369][ T6163] [ 33.796572][ T6163] ERROR: (device loop0): remounting filesystem as read-only [ 33.798496][ T6163] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 33.798496][ T6163] [ 33.801477][ T6163] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 33.801477][ T6163] [ 33.804589][ T6163] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 33.804589][ T6163] [ 33.807558][ T6163] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 33.807558][ T6163]