ERROR: (device loop0): dtReadFirst: stbl[0] out of bound ERROR: (device loop0): remounting filesystem as read-only ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:784:21 index -1 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 6840 Comm: syz.0.35 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:455 dtSearch+0x1664/0x1d00 fs/jfs/jfs_dtree.c:784 jfs_lookup+0x13c/0x32c fs/jfs/namei.c:1461 __lookup_slow+0x254/0x378 fs/namei.c:1858 lookup_slow+0x5c/0x80 fs/namei.c:1875 walk_component fs/namei.c:2221 [inline] link_path_walk+0xaf8/0x152c fs/namei.c:2589 path_lookupat+0xc0/0x780 fs/namei.c:2745 filename_lookup+0x1ac/0x454 fs/namei.c:2775 user_path_at+0x50/0x74 fs/namei.c:3567 do_mount fs/namespace.c:4032 [inline] __do_sys_mount fs/namespace.c:4224 [inline] __se_sys_mount fs/namespace.c:4201 [inline] __arm64_sys_mount+0x3b0/0x468 fs/namespace.c:4201 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 ---[ end trace ]--- ================================================================== BUG: KASAN: slab-out-of-bounds in addressPXD fs/jfs/jfs_types.h:80 [inline] BUG: KASAN: slab-out-of-bounds in dtSearch+0x1680/0x1d00 fs/jfs/jfs_dtree.c:785 Read of size 4 at addr ffff0000f9d60fe0 by task syz.0.35/6840 CPU: 0 UID: 0 PID: 6840 Comm: syz.0.35 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0xb0/0x110 mm/kasan/report.c:595 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 addressPXD fs/jfs/jfs_types.h:80 [inline] dtSearch+0x1680/0x1d00 fs/jfs/jfs_dtree.c:785 jfs_lookup+0x13c/0x32c fs/jfs/namei.c:1461 __lookup_slow+0x254/0x378 fs/namei.c:1858 lookup_slow+0x5c/0x80 fs/namei.c:1875 walk_component fs/namei.c:2221 [inline] link_path_walk+0xaf8/0x152c fs/namei.c:2589 path_lookupat+0xc0/0x780 fs/namei.c:2745 filename_lookup+0x1ac/0x454 fs/namei.c:2775 user_path_at+0x50/0x74 fs/namei.c:3567 do_mount fs/namespace.c:4032 [inline] __do_sys_mount fs/namespace.c:4224 [inline] __se_sys_mount fs/namespace.c:4201 [inline] __arm64_sys_mount+0x3b0/0x468 fs/namespace.c:4201 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Allocated by task 6840: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:77 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 unpoison_slab_object mm/kasan/common.c:339 [inline] __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:365 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x344/0x680 mm/slub.c:5270 mempool_alloc_slab+0x58/0x74 mm/mempool.c:723 mempool_alloc_noprof+0x170/0x2a0 mm/mempool.c:567 alloc_metapage fs/jfs/jfs_metapage.c:264 [inline] __get_metapage+0x52c/0xe90 fs/jfs/jfs_metapage.c:760 dtReadFirst+0xcc/0x7b8 fs/jfs/jfs_dtree.c:3079 jfs_readdir+0x548/0x3018 fs/jfs/jfs_dtree.c:2832 wrap_directory_iterator+0x90/0xf0 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x2dc/0x478 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:410 [inline] __se_sys_getdents64 fs/readdir.c:396 [inline] __arm64_sys_getdents64+0x110/0x2fc fs/readdir.c:396 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Freed by task 6840: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:77 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6668 [inline] kmem_cache_free+0x184/0x6e4 mm/slub.c:6779 mempool_free_slab+0x28/0x38 mm/mempool.c:730 mempool_free+0xec/0x138 mm/mempool.c:712 free_metapage fs/jfs/jfs_metapage.c:279 [inline] drop_metapage fs/jfs/jfs_metapage.c:316 [inline] release_metapage+0x730/0xa3c fs/jfs/jfs_metapage.c:892 dtReadFirst+0x604/0x7b8 fs/jfs/jfs_dtree.c:3112 jfs_readdir+0x548/0x3018 fs/jfs/jfs_dtree.c:2832 wrap_directory_iterator+0x90/0xf0 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x2dc/0x478 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:410 [inline] __se_sys_getdents64 fs/readdir.c:396 [inline] __arm64_sys_getdents64+0x110/0x2fc fs/readdir.c:396 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 The buggy address belongs to the object at ffff0000f9d60e88 which belongs to the cache jfs_mp of size 184 The buggy address is located 160 bytes to the right of allocated 184-byte region [ffff0000f9d60e88, ffff0000f9d60f40) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x139d60 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c50498c0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000f9d60e80: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000f9d60f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff0000f9d60f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0000f9d61000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000f9d61080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ERROR: (device loop0): dtSearch: stack overrun! btstack dump: bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 0, index = 0 jfs_lookup: dtSearch returned -5 ERROR: (device loop0): dtSearch: stack overrun! btstack dump: bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 0, index = 0 jfs_lookup: dtSearch returned -5 ERROR: (device loop0): dtSearch: stack overrun! btstack dump: bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 0, index = 0 jfs_lookup: dtSearch returned -5