Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. executing program [ 29.464663][ T6160] loop0: detected capacity change from 0 to 32768 [ 29.476364][ T6160] ------------[ cut here ]------------ [ 29.477662][ T6160] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 29.479465][ T6160] index -1 is out of range for type 'struct dtslot[128]' [ 29.481521][ T6160] CPU: 0 PID: 6160 Comm: syz-executor708 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 29.483747][ T6160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.486057][ T6160] Call trace: [ 29.486825][ T6160] dump_backtrace+0x1b8/0x1e4 [ 29.487843][ T6160] show_stack+0x2c/0x3c [ 29.488767][ T6160] dump_stack_lvl+0xd0/0x124 [ 29.489879][ T6160] dump_stack+0x1c/0x28 [ 29.490833][ T6160] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 29.492160][ T6160] jfs_readdir+0x1580/0x37bc [ 29.493224][ T6160] wrap_directory_iterator+0xa8/0xf4 [ 29.494403][ T6160] shared_jfs_readdir+0x30/0x40 [ 29.495433][ T6160] iterate_dir+0x3f8/0x580 [ 29.496514][ T6160] __arm64_sys_getdents64+0x1c4/0x4a0 [ 29.497822][ T6160] invoke_syscall+0x98/0x2b8 [ 29.498776][ T6160] el0_svc_common+0x130/0x23c [ 29.499850][ T6160] do_el0_svc+0x48/0x58 [ 29.500870][ T6160] el0_svc+0x54/0x168 [ 29.501821][ T6160] el0t_64_sync_handler+0x84/0xfc [ 29.502909][ T6160] el0t_64_sync+0x190/0x194 [ 29.504803][ T6160] ---[ end trace ]--- [ 29.505799][ T6160] ------------[ cut here ]------------ [ 29.507033][ T6160] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 29.508855][ T6160] index -1 is out of range for type 'struct dtslot[128]' [ 29.510459][ T6160] CPU: 1 PID: 6160 Comm: syz-executor708 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 29.512642][ T6160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.515067][ T6160] Call trace: [ 29.515826][ T6160] dump_backtrace+0x1b8/0x1e4 [ 29.516942][ T6160] show_stack+0x2c/0x3c [ 29.517923][ T6160] dump_stack_lvl+0xd0/0x124 [ 29.519005][ T6160] dump_stack+0x1c/0x28 [ 29.519960][ T6160] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 29.521319][ T6160] jfs_readdir+0x1dfc/0x37bc [ 29.522553][ T6160] wrap_directory_iterator+0xa8/0xf4 [ 29.523774][ T6160] shared_jfs_readdir+0x30/0x40 [ 29.524884][ T6160] iterate_dir+0x3f8/0x580 [ 29.525932][ T6160] __arm64_sys_getdents64+0x1c4/0x4a0 [ 29.527151][ T6160] invoke_syscall+0x98/0x2b8 [ 29.528200][ T6160] el0_svc_common+0x130/0x23c [ 29.529350][ T6160] do_el0_svc+0x48/0x58 [ 29.530342][ T6160] el0_svc+0x54/0x168 [ 29.531227][ T6160] el0t_64_sync_handler+0x84/0xfc [ 29.532383][ T6160] el0t_64_sync+0x190/0x194 [ 29.533779][ T6160] ---[ end trace ]--- [ 29.534833][ T6160] ------------[ cut here ]------------ [ 29.536078][ T6160] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 29.537830][ T6160] index 255 is out of range for type 'struct dtslot[128]' [ 29.539425][ T6160] CPU: 1 PID: 6160 Comm: syz-executor708 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 29.541657][ T6160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.543961][ T6160] Call trace: [ 29.544733][ T6160] dump_backtrace+0x1b8/0x1e4 [ 29.545810][ T6160] show_stack+0x2c/0x3c [ 29.546768][ T6160] dump_stack_lvl+0xd0/0x124 [ 29.547895][ T6160] dump_stack+0x1c/0x28 [ 29.548890][ T6160] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 29.550175][ T6160] diWrite+0xbcc/0x15cc [ 29.551116][ T6160] txCommit+0x750/0x5438 [ 29.552136][ T6160] jfs_readdir+0x1e80/0x37bc [ 29.553274][ T6160] wrap_directory_iterator+0xa8/0xf4 [ 29.554498][ T6160] shared_jfs_readdir+0x30/0x40 [ 29.555649][ T6160] iterate_dir+0x3f8/0x580 [ 29.556569][ T6160] __arm64_sys_getdents64+0x1c4/0x4a0 [ 29.557779][ T6160] invoke_syscall+0x98/0x2b8 [ 29.558854][ T6160] el0_svc_common+0x130/0x23c [ 29.559949][ T6160] do_el0_svc+0x48/0x58 [ 29.561004][ T6160] el0_svc+0x54/0x168 [ 29.561960][ T6160] el0t_64_sync_handler+0x84/0xfc [ 29.563107][ T6160] el0t_64_sync+0x190/0x194 [ 29.564344][ T6160] ---[ end trace ]--- [ 29.565271][ T6160] ------------[ cut here ]------------ [ 29.566437][ T6160] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 29.568137][ T6160] index 255 is out of range for type 'struct dtslot[128]' [ 29.569634][ T6160] CPU: 1 PID: 6160 Comm: syz-executor708 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 29.572017][ T6160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.574489][ T6160] Call trace: [ 29.575243][ T6160] dump_backtrace+0x1b8/0x1e4 [ 29.576387][ T6160] show_stack+0x2c/0x3c [ 29.577427][ T6160] dump_stack_lvl+0xd0/0x124 [ 29.578645][ T6160] dump_stack+0x1c/0x28 [ 29.579585][ T6160] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 29.580924][ T6160] diWrite+0xc24/0x15cc [ 29.581864][ T6160] txCommit+0x750/0x5438 [ 29.582827][ T6160] jfs_readdir+0x1e80/0x37bc [ 29.583881][ T6160] wrap_directory_iterator+0xa8/0xf4 [ 29.585206][ T6160] shared_jfs_readdir+0x30/0x40 [ 29.586288][ T6160] iterate_dir+0x3f8/0x580 [ 29.587382][ T6160] __arm64_sys_getdents64+0x1c4/0x4a0 [ 29.588576][ T6160] invoke_syscall+0x98/0x2b8 [ 29.589640][ T6160] el0_svc_common+0x130/0x23c [ 29.590801][ T6160] do_el0_svc+0x48/0x58 [ 29.591815][ T6160] el0_svc+0x54/0x168 [ 29.592677][ T6160] el0t_64_sync_handler+0x84/0xfc [ 29.593843][ T6160] el0t_64_sync+0x190/0x194 [ 29.595037][ T6160] ---[ end trace ]--- [ 29.595907][ T6160] ================================================================== [ 29.597751][ T6160] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 29.599257][ T6160] Read of size 32 at addr ffff0000db625110 by task syz-executor708/6160 [ 29.601184][ T6160] [ 29.601705][ T6160] CPU: 1 PID: 6160 Comm: syz-executor708 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 29.604070][ T6160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.606493][ T6160] Call trace: [ 29.607175][ T6160] dump_backtrace+0x1b8/0x1e4 [ 29.608327][ T6160] show_stack+0x2c/0x3c [ 29.609363][ T6160] dump_stack_lvl+0xd0/0x124 [ 29.610511][ T6160] print_report+0x178/0x518 [ 29.611713][ T6160] kasan_report+0xd8/0x138 [ 29.612721][ T6160] kasan_check_range+0x254/0x294 [ 29.613922][ T6160] __asan_memcpy+0x3c/0x84 [ 29.614944][ T6160] diWrite+0xb48/0x15cc [ 29.615967][ T6160] txCommit+0x750/0x5438 [ 29.616879][ T6160] jfs_readdir+0x1e80/0x37bc [ 29.617871][ T6160] wrap_directory_iterator+0xa8/0xf4 [ 29.619173][ T6160] shared_jfs_readdir+0x30/0x40 [ 29.620307][ T6160] iterate_dir+0x3f8/0x580 [ 29.621454][ T6160] __arm64_sys_getdents64+0x1c4/0x4a0 [ 29.622702][ T6160] invoke_syscall+0x98/0x2b8 [ 29.623785][ T6160] el0_svc_common+0x130/0x23c [ 29.624896][ T6160] do_el0_svc+0x48/0x58 [ 29.625897][ T6160] el0_svc+0x54/0x168 [ 29.626768][ T6160] el0t_64_sync_handler+0x84/0xfc [ 29.627904][ T6160] el0t_64_sync+0x190/0x194 [ 29.628950][ T6160] [ 29.629510][ T6160] The buggy address belongs to the object at ffff0000db624a00 [ 29.629510][ T6160] which belongs to the cache jfs_ip of size 2240 [ 29.632895][ T6160] The buggy address is located 1808 bytes inside of [ 29.632895][ T6160] allocated 2240-byte region [ffff0000db624a00, ffff0000db6252c0) [ 29.636223][ T6160] [ 29.636730][ T6160] The buggy address belongs to the physical page: [ 29.638137][ T6160] page:00000000abb09dfd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b620 [ 29.640416][ T6160] head:00000000abb09dfd order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.642446][ T6160] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 29.644396][ T6160] page_type: 0xffffffff() [ 29.645422][ T6160] raw: 05ffc00000000840 ffff0000c4311500 dead000000000122 0000000000000000 [ 29.647342][ T6160] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 29.649340][ T6160] page dumped because: kasan: bad access detected [ 29.650849][ T6160] [ 29.651379][ T6160] Memory state around the buggy address: [ 29.652716][ T6160] ffff0000db625000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.654575][ T6160] ffff0000db625080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.656400][ T6160] >ffff0000db625100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.658238][ T6160] ^ [ 29.659292][ T6160] ffff0000db625180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.661297][ T6160] ffff0000db625200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.663155][ T6160] ================================================================== [ 29.664903][ T6160] Disabling lock debugging due to kernel taint [ 29.666239][ T6160] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 29.666239][ T6160] [ 29.668983][ T6160] ERROR: (device loop0): remounting filesystem as read-only [ 29.670569][ T6160] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 29.670569][ T6160] [ 29.673185][ T6160] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 29.673185][ T6160] [ 29.675676][ T6160] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 29.675676][ T6160] [ 29.677969][ T6160] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 29.677969][ T6160]