loop0: detected capacity change from 0 to 512 /dev/loop0: Can't open blockdev loop0: detected capacity change from 0 to 32768 ... Log Wrap ... Log Wrap ... Log Wrap ... jfs_lookup: dtSearch returned -5 ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... Zero length message leads to an empty skb jfs_lookup: dtSearch returned -5 jfs_lookup: dtSearch returned -5 jfs_lookup: dtSearch returned -5 find_entry called with index >= next_index ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1998:37 index -128 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455 dtSplitRoot+0xae9/0x16c0 fs/jfs/jfs_dtree.c:1998 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline] dtInsert+0xef8/0x5f40 fs/jfs/jfs_dtree.c:871 jfs_mkdir+0x6ec/0xa70 fs/jfs/namei.c:270 vfs_mkdir+0x303/0x510 fs/namei.c:4366 do_mkdirat+0x247/0x590 fs/namei.c:4399 __do_sys_mkdirat fs/namei.c:4416 [inline] __se_sys_mkdirat fs/namei.c:4414 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4414 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8fe3d8d417 Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8fe4c18e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f8fe4c18ef0 RCX: 00007f8fe3d8d417 RDX: 00000000000001ff RSI: 00002000000001c0 RDI: 00000000ffffff9c RBP: 0000200000000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000200000000140 R11: 0000000000000246 R12: 00002000000001c0 R13: 00007f8fe4c18eb0 R14: 0000000000000000 R15: 0000200000000380 ---[ end trace ]---