... Log Wrap ... Log Wrap ... Log Wrap ...
find_entry called with index >= next_index
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1998:37
index -128 is out of range for type 'struct dtslot[128]'
CPU: 0 UID: 0 PID: 8425 Comm: syz.4.380 Not tainted 6.16.0-rc6-syzkaller-gaaef6f251176 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:455
 dtSplitRoot+0x87c/0x12f4 fs/jfs/jfs_dtree.c:1998
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x5a4/0x8b4 fs/jfs/namei.c:270
 vfs_mkdir+0x284/0x424 fs/namei.c:4375
 do_mkdirat+0x1f8/0x4c8 fs/namei.c:4408
 __do_sys_mkdirat fs/namei.c:4425 [inline]
 __se_sys_mkdirat fs/namei.c:4423 [inline]
 __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4423
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
---[ end trace ]---
==================================================================
BUG: KASAN: use-after-free in dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999
Read of size 4 at addr ffff0000f2e7b01c by task syz.4.380/8425

CPU: 0 UID: 0 PID: 8425 Comm: syz.4.380 Not tainted 6.16.0-rc6-syzkaller-gaaef6f251176 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x220 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:480
 kasan_report+0xb0/0x110 mm/kasan/report.c:593
 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
 dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x5a4/0x8b4 fs/jfs/namei.c:270
 vfs_mkdir+0x284/0x424 fs/namei.c:4375
 do_mkdirat+0x1f8/0x4c8 fs/namei.c:4408
 __do_sys_mkdirat fs/namei.c:4425 [inline]
 __se_sys_mkdirat fs/namei.c:4423 [inline]
 __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4423
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132e7b
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffdffc3c08948 fffffdffc3b04508 0000000000000000
raw: 0000000000000000 ffff0000f2e7a000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f2e7af00: fa fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb
 ffff0000f2e7af80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000f2e7b000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000f2e7b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000f2e7b100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
find_entry called with index = 0

 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...