loop2: detected capacity change from 0 to 32768 ================================================================== BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:750 Write of size 32 at addr ffff0000d13170c0 by task syz-executor.2/9322 CPU: 1 PID: 9322 Comm: syz-executor.2 Not tainted 6.9.0-rc6-syzkaller-g78186bd77b47 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x198/0x538 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189 __asan_memcpy+0x54/0x84 mm/kasan/shadow.c:106 diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:750 txCommit+0x750/0x5438 fs/jfs/jfs_txnmgr.c:1255 add_missing_indices fs/jfs/jfs_dtree.c:2661 [inline] jfs_readdir+0x1e80/0x37bc fs/jfs/jfs_dtree.c:3009 wrap_directory_iterator+0xa8/0xf4 fs/readdir.c:67 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x3f8/0x580 fs/readdir.c:110 __do_sys_getdents64 fs/readdir.c:409 [inline] __se_sys_getdents64 fs/readdir.c:394 [inline] __arm64_sys_getdents64+0x1c4/0x4a0 fs/readdir.c:394 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Allocated by task 8001: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3798 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc+0x1dc/0x3c0 mm/slub.c:3852 kmem_cache_zalloc include/linux/slab.h:739 [inline] __kernfs_new_node+0xe4/0x684 fs/kernfs/dir.c:624 kernfs_new_node+0x11c/0x230 fs/kernfs/dir.c:700 __kernfs_create_file+0x60/0x2d4 fs/kernfs/file.c:1034 sysfs_add_file_mode_ns+0x1dc/0x298 fs/sysfs/file.c:307 create_files fs/sysfs/group.c:76 [inline] internal_create_group+0x5e4/0xe44 fs/sysfs/group.c:180 internal_create_groups fs/sysfs/group.c:220 [inline] sysfs_create_groups+0x60/0x130 fs/sysfs/group.c:246 device_add_groups drivers/base/core.c:2822 [inline] device_add_attrs+0xd8/0x750 drivers/base/core.c:2931 device_add+0x4bc/0xaac drivers/base/core.c:3674 netdev_register_kobject+0x15c/0x2e8 net/core/net-sysfs.c:2136 register_netdevice+0xae8/0x10f0 net/core/dev.c:10283 virt_wifi_newlink+0x318/0x69c drivers/net/wireless/virtual/virt_wifi.c:553 rtnl_newlink_create net/core/rtnetlink.c:3494 [inline] __rtnl_newlink net/core/rtnetlink.c:3714 [inline] rtnl_newlink+0x1184/0x1bcc net/core/rtnetlink.c:3727 rtnetlink_rcv_msg+0x724/0xdbc net/core/rtnetlink.c:6595 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x65c/0x898 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7a0/0xa84 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2199 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The buggy address belongs to the object at ffff0000d1317000 which belongs to the cache kernfs_node_cache of size 176 The buggy address is located 16 bytes to the right of allocated 176-byte region [ffff0000d1317000, ffff0000d13170b0) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111317 flags: 0x5ffe00000000800(slab|node=0|zone=2|lastcpupid=0xfff) page_type: 0xffffffff() raw: 05ffe00000000800 ffff0000c1886000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d1316f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000d1317000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000d1317080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 ^ ffff0000d1317100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000d1317180: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ================================================================== ERROR: (device loop2): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 ERROR: (device loop2): remounting filesystem as read-only