Warning: Permanently added '10.128.0.135' (ED25519) to the list of known hosts. executing program [ 32.602665][ T6166] loop0: detected capacity change from 0 to 32768 [ 32.616473][ T6166] ------------[ cut here ]------------ [ 32.617892][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 32.619976][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 32.621741][ T6166] CPU: 0 PID: 6166 Comm: syz-executor270 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.624130][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.626618][ T6166] Call trace: [ 32.627466][ T6166] dump_backtrace+0x1b8/0x1e4 [ 32.628660][ T6166] show_stack+0x2c/0x3c [ 32.629735][ T6166] dump_stack_lvl+0xd0/0x124 [ 32.630907][ T6166] dump_stack+0x1c/0x28 [ 32.631980][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.633478][ T6166] jfs_readdir+0x1580/0x37bc [ 32.634716][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 32.636061][ T6166] shared_jfs_readdir+0x30/0x40 [ 32.637295][ T6166] iterate_dir+0x3f8/0x580 [ 32.638423][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.639752][ T6166] invoke_syscall+0x98/0x2b8 [ 32.640952][ T6166] el0_svc_common+0x130/0x23c [ 32.642102][ T6166] do_el0_svc+0x48/0x58 [ 32.643192][ T6166] el0_svc+0x54/0x168 [ 32.644225][ T6166] el0t_64_sync_handler+0x84/0xfc [ 32.645505][ T6166] el0t_64_sync+0x190/0x194 [ 32.647485][ T6166] ---[ end trace ]--- [ 32.648530][ T6166] ------------[ cut here ]------------ [ 32.649865][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 32.651858][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 32.653649][ T6166] CPU: 1 PID: 6166 Comm: syz-executor270 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.656208][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.658713][ T6166] Call trace: [ 32.659593][ T6166] dump_backtrace+0x1b8/0x1e4 [ 32.660787][ T6166] show_stack+0x2c/0x3c [ 32.661797][ T6166] dump_stack_lvl+0xd0/0x124 [ 32.662953][ T6166] dump_stack+0x1c/0x28 [ 32.664020][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.665539][ T6166] jfs_readdir+0x1dfc/0x37bc [ 32.666689][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 32.668158][ T6166] shared_jfs_readdir+0x30/0x40 [ 32.669385][ T6166] iterate_dir+0x3f8/0x580 [ 32.670372][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.671385][ T6166] invoke_syscall+0x98/0x2b8 [ 32.672308][ T6166] el0_svc_common+0x130/0x23c [ 32.673236][ T6166] do_el0_svc+0x48/0x58 [ 32.674020][ T6166] el0_svc+0x54/0x168 [ 32.674737][ T6166] el0t_64_sync_handler+0x84/0xfc [ 32.675884][ T6166] el0t_64_sync+0x190/0x194 [ 32.677728][ T6166] ---[ end trace ]--- [ 32.678866][ T6166] ------------[ cut here ]------------ [ 32.680351][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 32.682300][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 32.684159][ T6166] CPU: 1 PID: 6166 Comm: syz-executor270 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.686818][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.689520][ T6166] Call trace: [ 32.690401][ T6166] dump_backtrace+0x1b8/0x1e4 [ 32.691626][ T6166] show_stack+0x2c/0x3c [ 32.692693][ T6166] dump_stack_lvl+0xd0/0x124 [ 32.693911][ T6166] dump_stack+0x1c/0x28 [ 32.695011][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.696560][ T6166] diWrite+0xbcc/0x15cc [ 32.697571][ T6166] txCommit+0x750/0x5438 [ 32.698691][ T6166] jfs_readdir+0x1e80/0x37bc [ 32.699915][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 32.701256][ T6166] shared_jfs_readdir+0x30/0x40 [ 32.702561][ T6166] iterate_dir+0x3f8/0x580 [ 32.703726][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.705197][ T6166] invoke_syscall+0x98/0x2b8 [ 32.706372][ T6166] el0_svc_common+0x130/0x23c [ 32.707518][ T6166] do_el0_svc+0x48/0x58 [ 32.708599][ T6166] el0_svc+0x54/0x168 [ 32.709672][ T6166] el0t_64_sync_handler+0x84/0xfc [ 32.711031][ T6166] el0t_64_sync+0x190/0x194 [ 32.712341][ T6166] ---[ end trace ]--- [ 32.713370][ T6166] ------------[ cut here ]------------ [ 32.714767][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 32.716854][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 32.718611][ T6166] CPU: 1 PID: 6166 Comm: syz-executor270 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.721201][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.723746][ T6166] Call trace: [ 32.724592][ T6166] dump_backtrace+0x1b8/0x1e4 [ 32.725772][ T6166] show_stack+0x2c/0x3c [ 32.726822][ T6166] dump_stack_lvl+0xd0/0x124 [ 32.727923][ T6166] dump_stack+0x1c/0x28 [ 32.728966][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 32.730550][ T6166] diWrite+0xc24/0x15cc [ 32.731635][ T6166] txCommit+0x750/0x5438 [ 32.732772][ T6166] jfs_readdir+0x1e80/0x37bc [ 32.733977][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 32.735346][ T6166] shared_jfs_readdir+0x30/0x40 [ 32.736538][ T6166] iterate_dir+0x3f8/0x580 [ 32.737765][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.739157][ T6166] invoke_syscall+0x98/0x2b8 [ 32.740366][ T6166] el0_svc_common+0x130/0x23c [ 32.741601][ T6166] do_el0_svc+0x48/0x58 [ 32.742618][ T6166] el0_svc+0x54/0x168 [ 32.743608][ T6166] el0t_64_sync_handler+0x84/0xfc [ 32.744904][ T6166] el0t_64_sync+0x190/0x194 [ 32.746156][ T6166] ---[ end trace ]--- [ 32.747145][ T6166] ================================================================== [ 32.749197][ T6166] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 32.750963][ T6166] Read of size 32 at addr ffff0000de87d110 by task syz-executor270/6166 [ 32.753028][ T6166] [ 32.753643][ T6166] CPU: 1 PID: 6166 Comm: syz-executor270 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 32.756119][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.758861][ T6166] Call trace: [ 32.759767][ T6166] dump_backtrace+0x1b8/0x1e4 [ 32.760999][ T6166] show_stack+0x2c/0x3c [ 32.762149][ T6166] dump_stack_lvl+0xd0/0x124 [ 32.763334][ T6166] print_report+0x178/0x518 [ 32.764474][ T6166] kasan_report+0xd8/0x138 [ 32.765559][ T6166] kasan_check_range+0x254/0x294 [ 32.766808][ T6166] __asan_memcpy+0x3c/0x84 [ 32.768012][ T6166] diWrite+0xb48/0x15cc [ 32.769050][ T6166] txCommit+0x750/0x5438 [ 32.770178][ T6166] jfs_readdir+0x1e80/0x37bc [ 32.771391][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 32.772740][ T6166] shared_jfs_readdir+0x30/0x40 [ 32.773960][ T6166] iterate_dir+0x3f8/0x580 [ 32.775104][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 32.776377][ T6166] invoke_syscall+0x98/0x2b8 [ 32.777517][ T6166] el0_svc_common+0x130/0x23c [ 32.778764][ T6166] do_el0_svc+0x48/0x58 [ 32.779889][ T6166] el0_svc+0x54/0x168 [ 32.780922][ T6166] el0t_64_sync_handler+0x84/0xfc [ 32.782231][ T6166] el0t_64_sync+0x190/0x194 [ 32.783443][ T6166] [ 32.784074][ T6166] The buggy address belongs to the object at ffff0000de87ca00 [ 32.784074][ T6166] which belongs to the cache jfs_ip of size 2240 [ 32.787556][ T6166] The buggy address is located 1808 bytes inside of [ 32.787556][ T6166] allocated 2240-byte region [ffff0000de87ca00, ffff0000de87d2c0) [ 32.791341][ T6166] [ 32.791972][ T6166] The buggy address belongs to the physical page: [ 32.793655][ T6166] page:0000000004e3efe3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e878 [ 32.796375][ T6166] head:0000000004e3efe3 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.798704][ T6166] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 32.800695][ T6166] page_type: 0xffffffff() [ 32.801838][ T6166] raw: 05ffc00000000840 ffff0000c4422b40 dead000000000122 0000000000000000 [ 32.803988][ T6166] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 32.806196][ T6166] page dumped because: kasan: bad access detected [ 32.807862][ T6166] [ 32.808437][ T6166] Memory state around the buggy address: [ 32.809875][ T6166] ffff0000de87d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.812027][ T6166] ffff0000de87d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.814089][ T6166] >ffff0000de87d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.816176][ T6166] ^ [ 32.817418][ T6166] ffff0000de87d180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.819459][ T6166] ffff0000de87d200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.821581][ T6166] ================================================================== [ 32.823672][ T6166] Disabling lock debugging due to kernel taint [ 32.825257][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 32.825257][ T6166] [ 32.828360][ T6166] ERROR: (device loop0): remounting filesystem as read-only [ 32.830134][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 32.830134][ T6166] [ 32.832944][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 32.832944][ T6166] [ 32.835899][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 32.835899][ T6166] [ 32.838757][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 32.838757][ T6166]