Warning: Permanently added '10.128.1.18' (ED25519) to the list of known hosts. executing program [ 36.583258][ T6166] loop0: detected capacity change from 0 to 32768 [ 36.596075][ T6166] ------------[ cut here ]------------ [ 36.597489][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 36.599462][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 36.601303][ T6166] CPU: 1 PID: 6166 Comm: syz-executor804 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.603894][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 36.606524][ T6166] Call trace: [ 36.607405][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.608660][ T6166] show_stack+0x2c/0x3c [ 36.609728][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.610901][ T6166] dump_stack+0x1c/0x28 [ 36.611983][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 36.613537][ T6166] jfs_readdir+0x1580/0x37bc [ 36.614801][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.616235][ T6166] shared_jfs_readdir+0x30/0x40 [ 36.617495][ T6166] iterate_dir+0x3f8/0x580 [ 36.618680][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.620088][ T6166] invoke_syscall+0x98/0x2b8 [ 36.621367][ T6166] el0_svc_common+0x130/0x23c [ 36.622647][ T6166] do_el0_svc+0x48/0x58 [ 36.623802][ T6166] el0_svc+0x54/0x168 [ 36.624834][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.626213][ T6166] el0t_64_sync+0x190/0x194 [ 36.627566][ T6166] ---[ end trace ]--- [ 36.628672][ T6166] ------------[ cut here ]------------ [ 36.630032][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 36.631989][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 36.634008][ T6166] CPU: 1 PID: 6166 Comm: syz-executor804 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.636592][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 36.639205][ T6166] Call trace: [ 36.640047][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.641204][ T6166] show_stack+0x2c/0x3c [ 36.642234][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.643434][ T6166] dump_stack+0x1c/0x28 [ 36.644492][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 36.646011][ T6166] jfs_readdir+0x1dfc/0x37bc [ 36.647259][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.648678][ T6166] shared_jfs_readdir+0x30/0x40 [ 36.649942][ T6166] iterate_dir+0x3f8/0x580 [ 36.651078][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.652444][ T6166] invoke_syscall+0x98/0x2b8 [ 36.653668][ T6166] el0_svc_common+0x130/0x23c [ 36.654888][ T6166] do_el0_svc+0x48/0x58 [ 36.655984][ T6166] el0_svc+0x54/0x168 [ 36.656990][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.658218][ T6166] el0t_64_sync+0x190/0x194 [ 36.659518][ T6166] ---[ end trace ]--- [ 36.660627][ T6166] ------------[ cut here ]------------ [ 36.662117][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 36.663985][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 36.665839][ T6166] CPU: 1 PID: 6166 Comm: syz-executor804 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.668383][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 36.670986][ T6166] Call trace: [ 36.671842][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.673067][ T6166] show_stack+0x2c/0x3c [ 36.674155][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.675354][ T6166] dump_stack+0x1c/0x28 [ 36.676506][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 36.678022][ T6166] diWrite+0xbcc/0x15cc [ 36.679105][ T6166] txCommit+0x750/0x5438 [ 36.680232][ T6166] jfs_readdir+0x1e80/0x37bc [ 36.681405][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.682735][ T6166] shared_jfs_readdir+0x30/0x40 [ 36.684011][ T6166] iterate_dir+0x3f8/0x580 [ 36.685178][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.686540][ T6166] invoke_syscall+0x98/0x2b8 [ 36.687823][ T6166] el0_svc_common+0x130/0x23c [ 36.689096][ T6166] do_el0_svc+0x48/0x58 [ 36.690188][ T6166] el0_svc+0x54/0x168 [ 36.691172][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.692458][ T6166] el0t_64_sync+0x190/0x194 [ 36.693778][ T6166] ---[ end trace ]--- [ 36.694772][ T6166] ------------[ cut here ]------------ [ 36.696141][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 36.698007][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 36.699879][ T6166] CPU: 1 PID: 6166 Comm: syz-executor804 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.702451][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 36.705021][ T6166] Call trace: [ 36.705829][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.707171][ T6166] show_stack+0x2c/0x3c [ 36.708242][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.709448][ T6166] dump_stack+0x1c/0x28 [ 36.710538][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 36.712007][ T6166] diWrite+0xc24/0x15cc [ 36.713103][ T6166] txCommit+0x750/0x5438 [ 36.714250][ T6166] jfs_readdir+0x1e80/0x37bc [ 36.715432][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.716869][ T6166] shared_jfs_readdir+0x30/0x40 [ 36.718163][ T6166] iterate_dir+0x3f8/0x580 [ 36.719374][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.720734][ T6166] invoke_syscall+0x98/0x2b8 [ 36.721859][ T6166] el0_svc_common+0x130/0x23c [ 36.723033][ T6166] do_el0_svc+0x48/0x58 [ 36.724141][ T6166] el0_svc+0x54/0x168 [ 36.725215][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.726555][ T6166] el0t_64_sync+0x190/0x194 [ 36.727810][ T6166] ---[ end trace ]--- [ 36.728827][ T6166] ================================================================== [ 36.730916][ T6166] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 36.732730][ T6166] Read of size 32 at addr ffff0000db7ed110 by task syz-executor804/6166 [ 36.734942][ T6166] [ 36.735581][ T6166] CPU: 1 PID: 6166 Comm: syz-executor804 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 36.738148][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 36.740691][ T6166] Call trace: [ 36.741564][ T6166] dump_backtrace+0x1b8/0x1e4 [ 36.742792][ T6166] show_stack+0x2c/0x3c [ 36.743852][ T6166] dump_stack_lvl+0xd0/0x124 [ 36.745136][ T6166] print_report+0x178/0x518 [ 36.746319][ T6166] kasan_report+0xd8/0x138 [ 36.747454][ T6166] kasan_check_range+0x254/0x294 [ 36.748770][ T6166] __asan_memcpy+0x3c/0x84 [ 36.749881][ T6166] diWrite+0xb48/0x15cc [ 36.751006][ T6166] txCommit+0x750/0x5438 [ 36.752171][ T6166] jfs_readdir+0x1e80/0x37bc [ 36.753331][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 36.754728][ T6166] shared_jfs_readdir+0x30/0x40 [ 36.755991][ T6166] iterate_dir+0x3f8/0x580 [ 36.757114][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 36.758559][ T6166] invoke_syscall+0x98/0x2b8 [ 36.759778][ T6166] el0_svc_common+0x130/0x23c [ 36.761009][ T6166] do_el0_svc+0x48/0x58 [ 36.762110][ T6166] el0_svc+0x54/0x168 [ 36.763178][ T6166] el0t_64_sync_handler+0x84/0xfc [ 36.764516][ T6166] el0t_64_sync+0x190/0x194 [ 36.765748][ T6166] [ 36.766381][ T6166] The buggy address belongs to the object at ffff0000db7eca00 [ 36.766381][ T6166] which belongs to the cache jfs_ip of size 2240 [ 36.769959][ T6166] The buggy address is located 1808 bytes inside of [ 36.769959][ T6166] allocated 2240-byte region [ffff0000db7eca00, ffff0000db7ed2c0) [ 36.773650][ T6166] [ 36.774217][ T6166] The buggy address belongs to the physical page: [ 36.775874][ T6166] page:0000000034940818 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b7e8 [ 36.778585][ T6166] head:0000000034940818 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.780898][ T6166] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 36.783116][ T6166] page_type: 0xffffffff() [ 36.784234][ T6166] raw: 05ffc00000000840 ffff0000c44ba3c0 dead000000000122 0000000000000000 [ 36.786488][ T6166] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 36.788870][ T6166] page dumped because: kasan: bad access detected [ 36.790575][ T6166] [ 36.791163][ T6166] Memory state around the buggy address: [ 36.792643][ T6166] ffff0000db7ed000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.794792][ T6166] ffff0000db7ed080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.796961][ T6166] >ffff0000db7ed100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.799087][ T6166] ^ [ 36.800340][ T6166] ffff0000db7ed180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.802487][ T6166] ffff0000db7ed200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.804642][ T6166] ================================================================== [ 36.806888][ T6166] Disabling lock debugging due to kernel taint [ 36.808493][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 36.808493][ T6166] [ 36.811528][ T6166] ERROR: (device loop0): remounting filesystem as read-only [ 36.813540][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 36.813540][ T6166] [ 36.816532][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 36.816532][ T6166] [ 36.819557][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 36.819557][ T6166] [ 36.822559][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 36.822559][ T6166]