Warning: Permanently added '10.128.0.249' (ED25519) to the list of known hosts. executing program [ 34.141269][ T6242] loop0: detected capacity change from 0 to 2048 [ 34.152330][ T6243] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 34.160636][ T6242] ------------[ cut here ]------------ [ 34.162145][ T6242] UBSAN: array-index-out-of-bounds in fs/nilfs2/dir.c:257:18 [ 34.164086][ T6242] index 15 is out of range for type 'unsigned char[15]' [ 34.165894][ T6242] CPU: 0 PID: 6242 Comm: syz-executor268 Not tainted 6.9.0-rc3-syzkaller-gb5d2afe8745b #0 [ 34.168349][ T6242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.170941][ T6242] Call trace: [ 34.171772][ T6242] dump_backtrace+0x1b8/0x1e4 [ 34.172922][ T6242] show_stack+0x2c/0x3c [ 34.174056][ T6242] dump_stack_lvl+0xe4/0x150 [ 34.175354][ T6242] dump_stack+0x1c/0x28 [ 34.176472][ T6242] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 34.178045][ T6242] nilfs_add_link+0xb64/0xc10 [ 34.179320][ T6242] nilfs_link+0x12c/0x1f8 [ 34.180488][ T6242] vfs_link+0x3e8/0x560 [ 34.181614][ T6242] do_linkat+0x2e0/0x620 [ 34.182681][ T6242] __arm64_sys_linkat+0xe4/0x100 [ 34.183956][ T6242] invoke_syscall+0x98/0x2b8 [ 34.185209][ T6242] el0_svc_common+0x130/0x23c [ 34.186486][ T6242] do_el0_svc+0x48/0x58 [ 34.187549][ T6242] el0_svc+0x54/0x168 [ 34.188697][ T6242] el0t_64_sync_handler+0x84/0xfc [ 34.189991][ T6242] el0t_64_sync+0x190/0x194 [ 34.191532][ T6242] ---[ end trace ]--- [ 34.192574][ T6242] ================================================================== [ 34.194634][ T6242] BUG: KASAN: global-out-of-bounds in nilfs_add_link+0xac4/0xc10 [ 34.196548][ T6242] Read of size 1 at addr ffff80008b394c8f by task syz-executor268/6242 [ 34.198661][ T6242] [ 34.199292][ T6242] CPU: 0 PID: 6242 Comm: syz-executor268 Not tainted 6.9.0-rc3-syzkaller-gb5d2afe8745b #0 [ 34.201852][ T6242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 34.204488][ T6242] Call trace: [ 34.205315][ T6242] dump_backtrace+0x1b8/0x1e4 [ 34.206545][ T6242] show_stack+0x2c/0x3c [ 34.207717][ T6242] dump_stack_lvl+0xe4/0x150 [ 34.208921][ T6242] print_report+0x198/0x538 [ 34.210160][ T6242] kasan_report+0xd8/0x138 [ 34.211315][ T6242] __asan_report_load1_noabort+0x20/0x2c [ 34.212895][ T6242] nilfs_add_link+0xac4/0xc10 [ 34.214168][ T6242] nilfs_link+0x12c/0x1f8 [ 34.215395][ T6242] vfs_link+0x3e8/0x560 [ 34.216534][ T6242] do_linkat+0x2e0/0x620 [ 34.217605][ T6242] __arm64_sys_linkat+0xe4/0x100 [ 34.218848][ T6242] invoke_syscall+0x98/0x2b8 [ 34.220039][ T6242] el0_svc_common+0x130/0x23c [ 34.221255][ T6242] do_el0_svc+0x48/0x58 [ 34.222384][ T6242] el0_svc+0x54/0x168 [ 34.223332][ T6242] el0t_64_sync_handler+0x84/0xfc [ 34.224640][ T6242] el0t_64_sync+0x190/0x194 [ 34.225882][ T6242] [ 34.226480][ T6242] The buggy address belongs to the variable: [ 34.228093][ T6242] nilfs_type_by_mode+0xf/0x40 [ 34.229314][ T6242] [ 34.229919][ T6242] The buggy address belongs to the virtual mapping at [ 34.229919][ T6242] [ffff80008af80000, ffff80008e9c0000) created by: [ 34.229919][ T6242] declare_kernel_vmas+0x58/0xb8 [ 34.234583][ T6242] [ 34.235242][ T6242] The buggy address belongs to the physical page: [ 34.237001][ T6242] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a9f94 [ 34.239284][ T6242] flags: 0x5ffe00000004000(reserved|node=0|zone=2|lastcpupid=0xfff) [ 34.241406][ T6242] page_type: 0xffffffff() [ 34.242500][ T6242] raw: 05ffe00000004000 fffffdffc5a7e508 fffffdffc5a7e508 0000000000000000 [ 34.244779][ T6242] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 34.247035][ T6242] page dumped because: kasan: bad access detected [ 34.248729][ T6242] [ 34.249326][ T6242] Memory state around the buggy address: [ 34.250800][ T6242] ffff80008b394b80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 06 f9 f9 f9 [ 34.252976][ T6242] ffff80008b394c00: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 [ 34.255126][ T6242] >ffff80008b394c80: 00 07 f9 f9 00 00 00 00 00 00 00 00 00 02 f9 f9 [ 34.257227][ T6242] ^ [ 34.258288][ T6242] ffff80008b394d00: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 34.260472][ T6242] ffff80008b394d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.262463][ T6242] ================================================================== [ 34.264742][ T6242] Disabling lock debugging due to kernel taint