Warning: Permanently added '10.128.0.69' (ED25519) to the list of known hosts. executing program [ 33.192435][ T6166] loop0: detected capacity change from 0 to 32768 [ 33.206239][ T6166] ------------[ cut here ]------------ [ 33.208195][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2892:30 [ 33.210330][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 33.212245][ T6166] CPU: 1 PID: 6166 Comm: syz-executor475 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.214895][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.217533][ T6166] Call trace: [ 33.218431][ T6166] dump_backtrace+0x1b8/0x1e4 [ 33.219673][ T6166] show_stack+0x2c/0x3c [ 33.220780][ T6166] dump_stack_lvl+0xd0/0x124 [ 33.222091][ T6166] dump_stack+0x1c/0x28 [ 33.223245][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.224829][ T6166] jfs_readdir+0x1580/0x37bc [ 33.226112][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 33.227569][ T6166] shared_jfs_readdir+0x30/0x40 [ 33.228840][ T6166] iterate_dir+0x3f8/0x580 [ 33.230040][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.231531][ T6166] invoke_syscall+0x98/0x2b8 [ 33.232712][ T6166] el0_svc_common+0x130/0x23c [ 33.233971][ T6166] do_el0_svc+0x48/0x58 [ 33.235100][ T6166] el0_svc+0x54/0x168 [ 33.236171][ T6166] el0t_64_sync_handler+0x84/0xfc [ 33.237523][ T6166] el0t_64_sync+0x190/0x194 [ 33.238867][ T6166] ---[ end trace ]--- [ 33.240022][ T6166] ------------[ cut here ]------------ [ 33.241425][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2647:28 [ 33.243497][ T6166] index -1 is out of range for type 'struct dtslot[128]' [ 33.245338][ T6166] CPU: 1 PID: 6166 Comm: syz-executor475 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.248070][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.250711][ T6166] Call trace: [ 33.251584][ T6166] dump_backtrace+0x1b8/0x1e4 [ 33.252806][ T6166] show_stack+0x2c/0x3c [ 33.253956][ T6166] dump_stack_lvl+0xd0/0x124 [ 33.255177][ T6166] dump_stack+0x1c/0x28 [ 33.256417][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.258088][ T6166] jfs_readdir+0x1dfc/0x37bc [ 33.259412][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 33.260914][ T6166] shared_jfs_readdir+0x30/0x40 [ 33.262272][ T6166] iterate_dir+0x3f8/0x580 [ 33.263483][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.264922][ T6166] invoke_syscall+0x98/0x2b8 [ 33.266282][ T6166] el0_svc_common+0x130/0x23c [ 33.267545][ T6166] do_el0_svc+0x48/0x58 [ 33.268706][ T6166] el0_svc+0x54/0x168 [ 33.269819][ T6166] el0t_64_sync_handler+0x84/0xfc [ 33.271337][ T6166] el0t_64_sync+0x190/0x194 [ 33.272777][ T6166] ---[ end trace ]--- [ 33.273968][ T6166] ------------[ cut here ]------------ [ 33.275391][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:12 [ 33.277538][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 33.279474][ T6166] CPU: 1 PID: 6166 Comm: syz-executor475 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.282221][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.284910][ T6166] Call trace: [ 33.285808][ T6166] dump_backtrace+0x1b8/0x1e4 [ 33.287008][ T6166] show_stack+0x2c/0x3c [ 33.288099][ T6166] dump_stack_lvl+0xd0/0x124 [ 33.289300][ T6166] dump_stack+0x1c/0x28 [ 33.290401][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.292014][ T6166] diWrite+0xbcc/0x15cc [ 33.293189][ T6166] txCommit+0x750/0x5438 [ 33.294354][ T6166] jfs_readdir+0x1e80/0x37bc [ 33.295617][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 33.297130][ T6166] shared_jfs_readdir+0x30/0x40 [ 33.298402][ T6166] iterate_dir+0x3f8/0x580 [ 33.299603][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.301044][ T6166] invoke_syscall+0x98/0x2b8 [ 33.302262][ T6166] el0_svc_common+0x130/0x23c [ 33.303532][ T6166] do_el0_svc+0x48/0x58 [ 33.304681][ T6166] el0_svc+0x54/0x168 [ 33.305838][ T6166] el0t_64_sync_handler+0x84/0xfc [ 33.307174][ T6166] el0t_64_sync+0x190/0x194 [ 33.308503][ T6166] ---[ end trace ]--- [ 33.309574][ T6166] ------------[ cut here ]------------ [ 33.311011][ T6166] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:750:35 [ 33.313090][ T6166] index 255 is out of range for type 'struct dtslot[128]' [ 33.314928][ T6166] CPU: 1 PID: 6166 Comm: syz-executor475 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.317665][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.320375][ T6166] Call trace: [ 33.321356][ T6166] dump_backtrace+0x1b8/0x1e4 [ 33.322630][ T6166] show_stack+0x2c/0x3c [ 33.323726][ T6166] dump_stack_lvl+0xd0/0x124 [ 33.324956][ T6166] dump_stack+0x1c/0x28 [ 33.326140][ T6166] __ubsan_handle_out_of_bounds+0xf8/0x148 [ 33.327690][ T6166] diWrite+0xc24/0x15cc [ 33.328837][ T6166] txCommit+0x750/0x5438 [ 33.329980][ T6166] jfs_readdir+0x1e80/0x37bc [ 33.331258][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 33.332766][ T6166] shared_jfs_readdir+0x30/0x40 [ 33.334094][ T6166] iterate_dir+0x3f8/0x580 [ 33.335272][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.336702][ T6166] invoke_syscall+0x98/0x2b8 [ 33.337963][ T6166] el0_svc_common+0x130/0x23c [ 33.339245][ T6166] do_el0_svc+0x48/0x58 [ 33.340411][ T6166] el0_svc+0x54/0x168 [ 33.341508][ T6166] el0t_64_sync_handler+0x84/0xfc [ 33.342873][ T6166] el0t_64_sync+0x190/0x194 [ 33.344187][ T6166] ---[ end trace ]--- [ 33.345308][ T6166] ================================================================== [ 33.347474][ T6166] BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc [ 33.349360][ T6166] Read of size 32 at addr ffff0000dbbb5110 by task syz-executor475/6166 [ 33.351675][ T6166] [ 33.352294][ T6166] CPU: 1 PID: 6166 Comm: syz-executor475 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 [ 33.355096][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.357828][ T6166] Call trace: [ 33.358662][ T6166] dump_backtrace+0x1b8/0x1e4 [ 33.359944][ T6166] show_stack+0x2c/0x3c [ 33.361106][ T6166] dump_stack_lvl+0xd0/0x124 [ 33.362285][ T6166] print_report+0x178/0x518 [ 33.363528][ T6166] kasan_report+0xd8/0x138 [ 33.364671][ T6166] kasan_check_range+0x254/0x294 [ 33.365951][ T6166] __asan_memcpy+0x3c/0x84 [ 33.367145][ T6166] diWrite+0xb48/0x15cc [ 33.368307][ T6166] txCommit+0x750/0x5438 [ 33.369454][ T6166] jfs_readdir+0x1e80/0x37bc [ 33.370680][ T6166] wrap_directory_iterator+0xa8/0xf4 [ 33.372143][ T6166] shared_jfs_readdir+0x30/0x40 [ 33.373440][ T6166] iterate_dir+0x3f8/0x580 [ 33.374637][ T6166] __arm64_sys_getdents64+0x1c4/0x4a0 [ 33.376112][ T6166] invoke_syscall+0x98/0x2b8 [ 33.377410][ T6166] el0_svc_common+0x130/0x23c [ 33.378703][ T6166] do_el0_svc+0x48/0x58 [ 33.379873][ T6166] el0_svc+0x54/0x168 [ 33.380900][ T6166] el0t_64_sync_handler+0x84/0xfc [ 33.382271][ T6166] el0t_64_sync+0x190/0x194 [ 33.383454][ T6166] [ 33.384111][ T6166] The buggy address belongs to the object at ffff0000dbbb4a00 [ 33.384111][ T6166] which belongs to the cache jfs_ip of size 2240 [ 33.387934][ T6166] The buggy address is located 1808 bytes inside of [ 33.387934][ T6166] allocated 2240-byte region [ffff0000dbbb4a00, ffff0000dbbb52c0) [ 33.391927][ T6166] [ 33.392573][ T6166] The buggy address belongs to the physical page: [ 33.394317][ T6166] page:00000000b8141180 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bbb0 [ 33.397145][ T6166] head:00000000b8141180 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.399531][ T6166] flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 33.401767][ T6166] page_type: 0xffffffff() [ 33.402981][ T6166] raw: 05ffc00000000840 ffff0000c45153c0 dead000000000122 0000000000000000 [ 33.405251][ T6166] raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000 [ 33.407525][ T6166] page dumped because: kasan: bad access detected [ 33.409297][ T6166] [ 33.409924][ T6166] Memory state around the buggy address: [ 33.411482][ T6166] ffff0000dbbb5000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.413673][ T6166] ffff0000dbbb5080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.415831][ T6166] >ffff0000dbbb5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.418089][ T6166] ^ [ 33.419320][ T6166] ffff0000dbbb5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.421513][ T6166] ffff0000dbbb5200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.423715][ T6166] ================================================================== [ 33.426026][ T6166] Disabling lock debugging due to kernel taint [ 33.427715][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 33.427715][ T6166] [ 33.430893][ T6166] ERROR: (device loop0): remounting filesystem as read-only [ 33.432926][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 [ 33.432926][ T6166] [ 33.435914][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 2 [ 33.435914][ T6166] [ 33.439037][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 33.439037][ T6166] [ 33.442120][ T6166] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 33.442120][ T6166]