Warning: Permanently added '10.128.0.230' (ED25519) to the list of known hosts. executing program [ 32.294218][ T6161] loop0: detected capacity change from 0 to 32768 [ 32.307498][ T6161] ------------[ cut here ]------------ [ 32.308994][ T6161] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 32.311281][ T6161] index -1 is out of range for type 'struct dtslot[128]' [ 32.313114][ T6161] CPU: 0 PID: 6161 Comm: syz-executor386 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.315665][ T6161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.318361][ T6161] Call trace: [ 32.319147][ T6161] dump_backtrace+0x1b8/0x1e4 [ 32.320431][ T6161] show_stack+0x2c/0x3c [ 32.321556][ T6161] dump_stack_lvl+0xd0/0x124 [ 32.322745][ T6161] dump_stack+0x1c/0x28 [ 32.323862][ T6161] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.325293][ T6161] jfs_readdir+0x1580/0x37bc [ 32.326491][ T6161] wrap_directory_iterator+0xa8/0xf4 [ 32.327902][ T6161] shared_jfs_readdir+0x30/0x40 [ 32.329202][ T6161] iterate_dir+0x3f8/0x580 [ 32.330392][ T6161] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.331792][ T6161] invoke_syscall+0x98/0x2b8 [ 32.332993][ T6161] el0_svc_common+0x130/0x23c [ 32.334250][ T6161] do_el0_svc+0x48/0x58 [ 32.335305][ T6161] el0_svc+0x54/0x168 [ 32.336354][ T6161] el0t_64_sync_handler+0x84/0xfc [ 32.337761][ T6161] el0t_64_sync+0x190/0x194 [ 32.339087][ T6161] ---[ end trace ]--- [ 32.340229][ T6161] ------------[ cut here ]------------ [ 32.341630][ T6161] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 32.343647][ T6161] index -1 is out of range for type 'struct dtslot[128]' [ 32.345541][ T6161] CPU: 0 PID: 6161 Comm: syz-executor386 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.348130][ T6161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.350666][ T6161] Call trace: [ 32.351480][ T6161] dump_backtrace+0x1b8/0x1e4 [ 32.352621][ T6161] show_stack+0x2c/0x3c [ 32.353648][ T6161] dump_stack_lvl+0xd0/0x124 [ 32.354852][ T6161] dump_stack+0x1c/0x28 [ 32.355940][ T6161] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.357325][ T6161] jfs_readdir+0x1dfc/0x37bc [ 32.358491][ T6161] wrap_directory_iterator+0xa8/0xf4 [ 32.359904][ T6161] shared_jfs_readdir+0x30/0x40 [ 32.361157][ T6161] iterate_dir+0x3f8/0x580 [ 32.362287][ T6161] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.363690][ T6161] invoke_syscall+0x98/0x2b8 [ 32.364874][ T6161] el0_svc_common+0x130/0x23c [ 32.366070][ T6161] do_el0_svc+0x48/0x58 [ 32.367136][ T6161] el0_svc+0x54/0x168 [ 32.368186][ T6161] el0t_64_sync_handler+0x84/0xfc [ 32.369547][ T6161] el0t_64_sync+0x190/0x194 [ 32.370787][ T6161] ---[ end trace ]--- [ 32.371914][ T6161] ------------[ cut here ]------------ [ 32.373351][ T6161] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 32.375276][ T6161] index 255 is out of range for type 'struct dtslot[128]' [ 32.377240][ T6161] CPU: 0 PID: 6161 Comm: syz-executor386 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.379715][ T6161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.382307][ T6161] Call trace: [ 32.383118][ T6161] dump_backtrace+0x1b8/0x1e4 [ 32.384346][ T6161] show_stack+0x2c/0x3c [ 32.385396][ T6161] dump_stack_lvl+0xd0/0x124 [ 32.386589][ T6161] dump_stack+0x1c/0x28 [ 32.387661][ T6161] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.389194][ T6161] diWrite+0xbcc/0x15cc [ 32.390337][ T6161] txCommit+0x750/0x5438 [ 32.391412][ T6161] jfs_readdir+0x1e80/0x37bc [ 32.392596][ T6161] wrap_directory_iterator+0xa8/0xf4 [ 32.393972][ T6161] shared_jfs_readdir+0x30/0x40 [ 32.395228][ T6161] iterate_dir+0x3f8/0x580 [ 32.396361][ T6161] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.397774][ T6161] invoke_syscall+0x98/0x2b8 [ 32.399007][ T6161] el0_svc_common+0x130/0x23c [ 32.400223][ T6161] do_el0_svc+0x48/0x58 [ 32.401322][ T6161] el0_svc+0x54/0x168 [ 32.402341][ T6161] el0t_64_sync_handler+0x84/0xfc [ 32.403654][ T6161] el0t_64_sync+0x190/0x194 [ 32.404944][ T6161] ---[ end trace ]--- [ 32.406021][ T6161] ------------[ cut here ]------------ [ 32.407324][ T6161] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 32.409271][ T6161] index 255 is out of range for type 'struct dtslot[128]' [ 32.411033][ T6161] CPU: 0 PID: 6161 Comm: syz-executor386 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.413620][ T6161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.416348][ T6161] Call trace: [ 32.417224][ T6161] dump_backtrace+0x1b8/0x1e4 [ 32.418372][ T6161] show_stack+0x2c/0x3c [ 32.419477][ T6161] dump_stack_lvl+0xd0/0x124 [ 32.420699][ T6161] dump_stack+0x1c/0x28 [ 32.421758][ T6161] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.423279][ T6161] diWrite+0xc24/0x15cc [ 32.424380][ T6161] txCommit+0x750/0x5438 [ 32.425531][ T6161] jfs_readdir+0x1e80/0x37bc [ 32.426742][ T6161] wrap_directory_iterator+0xa8/0xf4 [ 32.428123][ T6161] shared_jfs_readdir+0x30/0x40 [ 32.429413][ T6161] iterate_dir+0x3f8/0x580 [ 32.430565][ T6161] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.431973][ T6161] invoke_syscall+0x98/0x2b8 [ 32.433164][ T6161] el0_svc_common+0x130/0x23c [ 32.434447][ T6161] do_el0_svc+0x48/0x58 [ 32.435523][ T6161] el0_svc+0x54/0x168 [ 32.436547][ T6161] el0t_64_sync_handler+0x84/0xfc [ 32.437856][ T6161] el0t_64_sync+0x190/0x194 [ 32.439103][ T6161] ---[ end trace ]--- [ 32.440113][ T6161] ================================================================== [ 32.442192][ T6161] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 32.443961][ T6161] Read of size 32 at addr ffff0000dbbc5110 by task syz-executor386/6161 [ 32.446150][ T6161] [ 32.446771][ T6161] CPU: 0 PID: 6161 Comm: syz-executor386 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.449422][ T6161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.452223][ T6161] Call trace: [ 32.453119][ T6161] dump_backtrace+0x1b8/0x1e4 [ 32.454302][ T6161] show_stack+0x2c/0x3c [ 32.455444][ T6161] dump_stack_lvl+0xd0/0x124 [ 32.456638][ T6161] print_report+0x178/0x518 [ 32.457735][ T6161] kasan_report+0xd8/0x138 [ 32.458860][ T6161] kasan_check_range+0x254/0x294 [ 32.460248][ T6161] __asan_memcpy+0x3c/0x84 [ 32.461382][ T6161] diWrite+0xb48/0x15cc [ 32.462550][ T6161] txCommit+0x750/0x5438 [ 32.463694][ T6161] jfs_readdir+0x1e80/0x37bc [ 32.464953][ T6161] wrap_directory_iterator+0xa8/0xf4 [ 32.466397][ T6161] shared_jfs_readdir+0x30/0x40 [ 32.467675][ T6161] iterate_dir+0x3f8/0x580 [ 32.468841][ T6161] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.470315][ T6161] invoke_syscall+0x98/0x2b8 [ 32.471506][ T6161] el0_svc_common+0x130/0x23c [ 32.472730][ T6161] do_el0_svc+0x48/0x58 [ 32.473881][ T6161] el0_svc+0x54/0x168 [ 32.474950][ T6161] el0t_64_sync_handler+0x84/0xfc [ 32.476250][ T6161] el0t_64_sync+0x190/0x194 [ 32.477393][ T6161] [ 32.478002][ T6161] The buggy address belongs to the object at ffff0000dbbc4a00 [ 32.478002][ T6161] which belongs to the cache jfs_ip of size 2240 [ 32.481622][ T6161] The buggy address is located 1808 bytes inside of [ 32.481622][ T6161] allocated 2240-byte region [ffff0000dbbc4a00, ffff0000dbbc52c0) [ 32.485387][ T6161] [ 32.486016][ T6161] The buggy address belongs to the physical page: [ 32.487577][ T6161] page:000000005a8caa7a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bbc0 [ 32.490334][ T6161] head:000000005a8caa7a order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.492752][ T6161] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 32.494831][ T6161] page_type: 0xffffffff() [ 32.495996][ T6161] raw: 05ffc00000000840 ffff0000c4470280 dead000000000122 0000000000000000 [ 32.498277][ T6161] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 32.500494][ T6161] page dumped because: kasan: bad access detected [ 32.502128][ T6161] [ 32.502728][ T6161] Memory state around the buggy address: [ 32.504249][ T6161] ffff0000dbbc5000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.506460][ T6161] ffff0000dbbc5080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.508560][ T6161] >ffff0000dbbc5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.510645][ T6161] ^ [ 32.511866][ T6161] ffff0000dbbc5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.513942][ T6161] ffff0000dbbc5200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.516041][ T6161] ================================================================== [ 32.518275][ T6161] Disabling lock debugging due to kernel taint [ 32.519890][ T6161] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 32.519890][ T6161] [ 32.522996][ T6161] ERROR: (device loop0): remounting filesystem as read-only [ 32.524907][ T6161] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 32.524907][ T6161] [ 32.527931][ T6161] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 32.527931][ T6161] [ 32.530842][ T6161] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 32.530842][ T6161] [ 32.533813][ T6161] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 32.533813][ T6161]