Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. executing program [ 34.123559][ T6166] loop0: detected capacity change from 0 to 32768 [ 34.137561][ T6166] ------------[ cut here ]------------ [ 34.139042][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 34.150525][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 34.152356][ T6166] CPU: 1 PID: 6166 Comm: syz-executor136 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 34.154882][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.157572][ T6166] Call trace: [ 34.158397][ T6166] dump_backtrace+0x1b8/0x1e4 [ 34.159629][ T6166] show_stack+0x2c/0x3c [ 34.160692][ T6166] dump_stack_lvl+0xd0/0x124 [ 34.161972][ T6166] dump_stack+0x1c/0x28 [ 34.163119][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 34.164660][ T6166] jfs_readdir+0x1580/0x37bc [ 34.165909][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 34.167281][ T6166] shared_jfs_readdir+0x30/0x40 [ 34.168582][ T6166] iterate_dir+0x3f8/0x580 [ 34.169775][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 34.171236][ T6166] invoke_syscall+0x98/0x2b8 [ 34.172468][ T6166] el0_svc_common+0x130/0x23c [ 34.173700][ T6166] do_el0_svc+0x48/0x58 [ 34.174817][ T6166] el0_svc+0x54/0x168 [ 34.175923][ T6166] el0t_64_sync_handler+0x84/0xfc [ 34.177279][ T6166] el0t_64_sync+0x190/0x194 [ 34.179251][ T6166] ---[ end trace ]--- [ 34.180362][ T6166] ------------[ cut here ]------------ [ 34.181850][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 34.183887][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 34.186058][ T6166] CPU: 1 PID: 6166 Comm: syz-executor136 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 34.188574][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.191108][ T6166] Call trace: [ 34.191952][ T6166] dump_backtrace+0x1b8/0x1e4 [ 34.193168][ T6166] show_stack+0x2c/0x3c [ 34.194269][ T6166] dump_stack_lvl+0xd0/0x124 [ 34.195504][ T6166] dump_stack+0x1c/0x28 [ 34.196580][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 34.198080][ T6166] jfs_readdir+0x1dfc/0x37bc [ 34.199331][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 34.200741][ T6166] shared_jfs_readdir+0x30/0x40 [ 34.201990][ T6166] iterate_dir+0x3f8/0x580 [ 34.203166][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 34.204595][ T6166] invoke_syscall+0x98/0x2b8 [ 34.205802][ T6166] el0_svc_common+0x130/0x23c [ 34.206964][ T6166] do_el0_svc+0x48/0x58 [ 34.208047][ T6166] el0_svc+0x54/0x168 [ 34.209108][ T6166] el0t_64_sync_handler+0x84/0xfc [ 34.210404][ T6166] el0t_64_sync+0x190/0x194 [ 34.212083][ T6166] ---[ end trace ]--- [ 34.213181][ T6166] ------------[ cut here ]------------ [ 34.214670][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 34.216623][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 34.218412][ T6166] CPU: 1 PID: 6166 Comm: syz-executor136 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 34.221018][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.223550][ T6166] Call trace: [ 34.224336][ T6166] dump_backtrace+0x1b8/0x1e4 [ 34.225572][ T6166] show_stack+0x2c/0x3c [ 34.226631][ T6166] dump_stack_lvl+0xd0/0x124 [ 34.227850][ T6166] dump_stack+0x1c/0x28 [ 34.229007][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 34.230564][ T6166] diWrite+0xbcc/0x15cc [ 34.231640][ T6166] txCommit+0x750/0x5438 [ 34.232779][ T6166] jfs_readdir+0x1e80/0x37bc [ 34.234016][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 34.235451][ T6166] shared_jfs_readdir+0x30/0x40 [ 34.236747][ T6166] iterate_dir+0x3f8/0x580 [ 34.237918][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 34.239345][ T6166] invoke_syscall+0x98/0x2b8 [ 34.240546][ T6166] el0_svc_common+0x130/0x23c [ 34.241770][ T6166] do_el0_svc+0x48/0x58 [ 34.242823][ T6166] el0_svc+0x54/0x168 [ 34.243854][ T6166] el0t_64_sync_handler+0x84/0xfc [ 34.245205][ T6166] el0t_64_sync+0x190/0x194 [ 34.246494][ T6166] ---[ end trace ]--- [ 34.247561][ T6166] ------------[ cut here ]------------ [ 34.249014][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 34.250975][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 34.252829][ T6166] CPU: 1 PID: 6166 Comm: syz-executor136 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 34.255405][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.258010][ T6166] Call trace: [ 34.258841][ T6166] dump_backtrace+0x1b8/0x1e4 [ 34.260148][ T6166] show_stack+0x2c/0x3c [ 34.261256][ T6166] dump_stack_lvl+0xd0/0x124 [ 34.262468][ T6166] dump_stack+0x1c/0x28 [ 34.263548][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 34.265098][ T6166] diWrite+0xc24/0x15cc [ 34.266162][ T6166] txCommit+0x750/0x5438 [ 34.267234][ T6166] jfs_readdir+0x1e80/0x37bc [ 34.268420][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 34.269896][ T6166] shared_jfs_readdir+0x30/0x40 [ 34.271201][ T6166] iterate_dir+0x3f8/0x580 [ 34.272394][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 34.273864][ T6166] invoke_syscall+0x98/0x2b8 [ 34.275102][ T6166] el0_svc_common+0x130/0x23c [ 34.276327][ T6166] do_el0_svc+0x48/0x58 [ 34.277425][ T6166] el0_svc+0x54/0x168 [ 34.278504][ T6166] el0t_64_sync_handler+0x84/0xfc [ 34.279836][ T6166] el0t_64_sync+0x190/0x194 [ 34.281104][ T6166] ---[ end trace ]--- [ 34.282119][ T6166] ================================================================== [ 34.284192][ T6166] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 34.286032][ T6166] Read of size 32 at addr ffff0000deda5110 by task syz-executor136/6166 [ 34.288275][ T6166] [ 34.288860][ T6166] CPU: 1 PID: 6166 Comm: syz-executor136 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 34.291496][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.294129][ T6166] Call trace: [ 34.295009][ T6166] dump_backtrace+0x1b8/0x1e4 [ 34.296211][ T6166] show_stack+0x2c/0x3c [ 34.297340][ T6166] dump_stack_lvl+0xd0/0x124 [ 34.298567][ T6166] print_report+0x178/0x518 [ 34.299781][ T6166] kasan_report+0xd8/0x138 [ 34.300878][ T6166] kasan_check_range+0x254/0x294 [ 34.302194][ T6166] __asan_memcpy+0x3c/0x84 [ 34.303302][ T6166] diWrite+0xb48/0x15cc [ 34.304374][ T6166] txCommit+0x750/0x5438 [ 34.305592][ T6166] jfs_readdir+0x1e80/0x37bc [ 34.306785][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 34.308157][ T6166] shared_jfs_readdir+0x30/0x40 [ 34.309445][ T6166] iterate_dir+0x3f8/0x580 [ 34.310584][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 34.312050][ T6166] invoke_syscall+0x98/0x2b8 [ 34.313301][ T6166] el0_svc_common+0x130/0x23c [ 34.314504][ T6166] do_el0_svc+0x48/0x58 [ 34.315623][ T6166] el0_svc+0x54/0x168 [ 34.316758][ T6166] el0t_64_sync_handler+0x84/0xfc [ 34.318113][ T6166] el0t_64_sync+0x190/0x194 [ 34.319308][ T6166] [ 34.319897][ T6166] The buggy address belongs to the object at ffff0000deda4a00 [ 34.319897][ T6166] which belongs to the cache jfs_ip of size 2240 [ 34.323386][ T6166] The buggy address is located 1808 bytes inside of [ 34.323386][ T6166] allocated 2240-byte region [ffff0000deda4a00, ffff0000deda52c0) [ 34.327152][ T6166] [ 34.327737][ T6166] The buggy address belongs to the physical page: [ 34.329379][ T6166] page:00000000b11c174b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eda0 [ 34.332121][ T6166] head:00000000b11c174b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.334461][ T6166] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 34.336562][ T6166] page_type: 0xffffffff() [ 34.337670][ T6166] raw: 05ffc00000000840 ffff0000c40d2640 dead000000000122 0000000000000000 [ 34.339974][ T6166] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 34.342295][ T6166] page dumped because: kasan: bad access detected [ 34.343953][ T6166] [ 34.344567][ T6166] Memory state around the buggy address: [ 34.346086][ T6166] ffff0000deda5000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.348239][ T6166] ffff0000deda5080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.350407][ T6166] >ffff0000deda5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.352452][ T6166] ^ [ 34.353641][ T6166] ffff0000deda5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.355772][ T6166] ffff0000deda5200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.357922][ T6166] ================================================================== [ 34.360148][ T6166] Disabling lock debugging due to kernel taint [ 34.361714][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 34.361714][ T6166] [ 34.364873][ T6166] ERROR: (device loop0): remounting filesystem as read-only [ 34.366757][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 34.366757][ T6166] [ 34.369651][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 34.369651][ T6166] [ 34.372497][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 34.372497][ T6166] [ 34.375458][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 34.375458][ T6166]