==================================================================
BUG: KASAN: slab-out-of-bounds in dtCompare fs/jfs/jfs_dtree.c:3317 [inline]
BUG: KASAN: slab-out-of-bounds in dtSearch+0x131c/0x1f34 fs/jfs/jfs_dtree.c:649
Read of size 1 at addr ffff0000f4638118 by task syz.0.522/8084

CPU: 1 PID: 8084 Comm: syz.0.522 Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x174/0x4c0 mm/kasan/report.c:395
 kasan_report+0xd4/0x130 mm/kasan/report.c:495
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 dtCompare fs/jfs/jfs_dtree.c:3317 [inline]
 dtSearch+0x131c/0x1f34 fs/jfs/jfs_dtree.c:649
 jfs_lookup+0x164/0x39c fs/jfs/namei.c:1459
 lookup_one_qstr_excl+0x108/0x230 fs/namei.c:1605
 do_renameat2+0x5b8/0xe64 fs/namei.c:4977
 __do_sys_renameat2 fs/namei.c:5060 [inline]
 __se_sys_renameat2 fs/namei.c:5057 [inline]
 __arm64_sys_renameat2+0xe0/0xfc fs/namei.c:5057
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000f4638118
 which belongs to the cache f2fs_free_nid of size 24
The buggy address is located 0 bytes inside of
 24-byte region [ffff0000f4638118, ffff0000f4638130)

The buggy address belongs to the physical page:
page:000000009b568a76 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000f46380a0 pfn:0x134638
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c740bc80
raw: ffff0000f46380a0 0000000080660061 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f4638000: fb fb fb fc fc fb fb fb fc fc fb fb fb fc fc fb
 ffff0000f4638080: fb fb fc fc fb fb fb fc fc fc fc fc fc fc fc fc
>ffff0000f4638100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                            ^
 ffff0000f4638180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000f4638200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
ERROR: (device loop0): dtSearch: stack overrun!

ERROR: (device loop0): remounting filesystem as read-only
btstack dump:
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
jfs_lookup: dtSearch returned -5