Warning: Permanently added '10.128.10.14' (ED25519) to the list of known hosts. executing program [ 34.882192][ T4291] loop0: detected capacity change from 0 to 32768 [ 34.891077][ T4291] [ 34.891077][ T4291] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 34.891077][ T4291] [ 34.899045][ T4291] read_mapping_page failed! [ 34.900484][ T4291] ERROR: (device loop0): txAbort: [ 34.900484][ T4291] [ 34.904659][ T4291] read_mapping_page failed! [ 34.906114][ T4291] ERROR: (device loop0): txAbort: [ 34.906114][ T4291] [ 34.909766][ T4291] ================================================================== [ 34.912000][ T4291] BUG: KASAN: slab-out-of-bounds in dtInsertEntry+0xc78/0x1170 [ 34.914070][ T4291] Read of size 4 at addr ffff0000e1e5c04c by task syz-executor350/4291 [ 34.916285][ T4291] [ 34.916872][ T4291] CPU: 1 PID: 4291 Comm: syz-executor350 Not tainted 6.1.134-syzkaller #0 [ 34.919186][ T4291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 34.921990][ T4291] Call trace: [ 34.922940][ T4291] dump_backtrace+0x1c8/0x1f4 [ 34.924197][ T4291] show_stack+0x2c/0x3c [ 34.925282][ T4291] dump_stack_lvl+0x108/0x170 [ 34.926534][ T4291] print_report+0x174/0x4c0 [ 34.927777][ T4291] kasan_report+0xd4/0x130 [ 34.928978][ T4291] __asan_report_load4_noabort+0x2c/0x38 [ 34.930510][ T4291] dtInsertEntry+0xc78/0x1170 [ 34.931758][ T4291] dtSplitPage+0x22c8/0x3088 [ 34.933045][ T4291] dtInsert+0x110c/0x57a4 [ 34.934233][ T4291] jfs_create+0x698/0xa1c [ 34.935398][ T4291] vfs_create+0x2cc/0x434 [ 34.936552][ T4291] do_mknodat+0x390/0x610 [ 34.937727][ T4291] __arm64_sys_mknodat+0xb0/0xcc [ 34.939131][ T4291] invoke_syscall+0x98/0x2bc [ 34.940332][ T4291] el0_svc_common+0x138/0x258 [ 34.941668][ T4291] do_el0_svc+0x58/0x13c [ 34.942780][ T4291] el0_svc+0x58/0x168 [ 34.943924][ T4291] el0t_64_sync_handler+0x84/0xf0 [ 34.945353][ T4291] el0t_64_sync+0x18c/0x190 [ 34.946610][ T4291] [ 34.947235][ T4291] Allocated by task 4291: [ 34.948355][ T4291] kasan_set_track+0x4c/0x80 [ 34.949585][ T4291] kasan_save_alloc_info+0x24/0x30 [ 34.950919][ T4291] __kasan_slab_alloc+0x74/0x8c [ 34.952185][ T4291] slab_post_alloc_hook+0x74/0x458 [ 34.953559][ T4291] kmem_cache_alloc_lru+0x1ac/0x2f8 [ 34.954972][ T4291] jfs_alloc_inode+0x2c/0x68 [ 34.956271][ T4291] iget_locked+0x170/0x708 [ 34.957454][ T4291] jfs_iget+0x30/0x364 [ 34.958553][ T4291] jfs_lookup+0x1e8/0x39c [ 34.959734][ T4291] __lookup_slow+0x250/0x374 [ 34.961088][ T4291] lookup_slow+0x60/0x84 [ 34.962235][ T4291] link_path_walk+0x830/0xcc8 [ 34.963461][ T4291] __filename_parentat+0x1e4/0x5d0 [ 34.964754][ T4291] do_renameat2+0x2f4/0xe64 [ 34.965983][ T4291] __arm64_sys_renameat2+0xe0/0xfc [ 34.967359][ T4291] invoke_syscall+0x98/0x2bc [ 34.968631][ T4291] el0_svc_common+0x138/0x258 [ 34.969903][ T4291] do_el0_svc+0x58/0x13c [ 34.971030][ T4291] el0_svc+0x58/0x168 [ 34.972130][ T4291] el0t_64_sync_handler+0x84/0xf0 [ 34.973461][ T4291] el0t_64_sync+0x18c/0x190 [ 34.974678][ T4291] [ 34.975276][ T4291] The buggy address belongs to the object at ffff0000e1e5b780 [ 34.975276][ T4291] which belongs to the cache jfs_ip of size 2240 [ 34.979001][ T4291] The buggy address is located 12 bytes to the right of [ 34.979001][ T4291] 2240-byte region [ffff0000e1e5b780, ffff0000e1e5c040) [ 34.982694][ T4291] [ 34.983313][ T4291] The buggy address belongs to the physical page: [ 34.985022][ T4291] page:000000006b35f598 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121e58 [ 34.987895][ T4291] head:000000006b35f598 order:3 compound_mapcount:0 compound_pincount:0 [ 34.990206][ T4291] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 34.992424][ T4291] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c6f9a300 [ 34.994775][ T4291] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 34.997074][ T4291] page dumped because: kasan: bad access detected [ 34.998769][ T4291] [ 34.999376][ T4291] Memory state around the buggy address: [ 35.000871][ T4291] ffff0000e1e5bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.003066][ T4291] ffff0000e1e5bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.005289][ T4291] >ffff0000e1e5c000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 35.007530][ T4291] ^ [ 35.009218][ T4291] ffff0000e1e5c080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 35.011471][ T4291] ffff0000e1e5c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.013637][ T4291] ================================================================== [ 35.015964][ T4291] Disabling lock debugging due to kernel taint [ 35.017768][ T4291] find_entry called with index >= next_index [ 35.019483][ T4291] read_mapping_page failed! [ 35.020671][ T4291] ERROR: (device loop0): txAbort: [ 35.020671][ T4291]