================================================================== BUG: KASAN: slab-out-of-bounds in diWrite+0xd98/0x18d4 fs/jfs/jfs_imap.c:753 Write of size 32 at addr ffff0000cda650c0 by task syz.3.65/6915 CPU: 0 UID: 0 PID: 6915 Comm: syz.3.65 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0xb0/0x110 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 __asan_memcpy+0x54/0x84 mm/kasan/shadow.c:106 diWrite+0xd98/0x18d4 fs/jfs/jfs_imap.c:753 txCommit+0x5d0/0x3e00 fs/jfs/jfs_txnmgr.c:1255 add_missing_indices+0x710/0xadc fs/jfs/jfs_dtree.c:2674 jfs_readdir+0x1758/0x3018 fs/jfs/jfs_dtree.c:3031 wrap_directory_iterator+0x90/0xf0 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x2dc/0x478 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:410 [inline] __se_sys_getdents64 fs/readdir.c:396 [inline] __arm64_sys_getdents64+0x110/0x2fc fs/readdir.c:396 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Allocated by task 1: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:356 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4180 [inline] slab_alloc_node mm/slub.c:4229 [inline] kmem_cache_alloc_noprof+0x238/0x3e8 mm/slub.c:4236 __kernfs_new_node+0xe4/0x5c4 fs/kernfs/dir.c:637 kernfs_new_node+0xe8/0x1f4 fs/kernfs/dir.c:713 __kernfs_create_file+0x60/0x2d4 fs/kernfs/file.c:1039 sysfs_add_file_mode_ns+0x1d8/0x294 fs/sysfs/file.c:319 sysfs_merge_group+0x15c/0x298 fs/sysfs/group.c:376 dpm_sysfs_add+0xc8/0x260 drivers/base/power/sysfs.c:704 device_add+0x4d8/0xa60 drivers/base/core.c:3649 device_register+0x28/0x38 drivers/base/core.c:3771 usb_create_ep_devs+0x124/0x220 drivers/usb/core/endpoint.c:170 create_intf_ep_devs drivers/usb/core/message.c:1252 [inline] usb_set_configuration+0x1720/0x1bac drivers/usb/core/message.c:2216 usb_generic_driver_probe+0x8c/0x144 drivers/usb/core/generic.c:250 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 usb_probe_device+0x1a4/0x348 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3b4/0x944 drivers/base/dd.c:659 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:801 driver_probe_device+0x78/0x330 drivers/base/dd.c:831 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:959 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462 __device_attach+0x26c/0x388 drivers/base/dd.c:1031 device_initial_probe+0x24/0x34 drivers/base/dd.c:1080 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x71c/0xa60 drivers/base/core.c:3689 usb_new_device+0x7f0/0x123c drivers/usb/core/hub.c:2694 register_root_hub+0x220/0x528 drivers/usb/core/hcd.c:994 usb_add_hcd+0x958/0xdd0 drivers/usb/core/hcd.c:2989 vhci_hcd_probe+0x13c/0x358 drivers/usb/usbip/vhci_hcd.c:1363 platform_probe+0xfc/0x198 drivers/base/platform.c:1405 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3b4/0x944 drivers/base/dd.c:659 __driver_probe_device+0x180/0x2d4 drivers/base/dd.c:801 driver_probe_device+0x78/0x330 drivers/base/dd.c:831 __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:959 bus_for_each_drv+0x220/0x2b4 drivers/base/bus.c:462 __device_attach+0x26c/0x388 drivers/base/dd.c:1031 device_initial_probe+0x24/0x34 drivers/base/dd.c:1080 bus_probe_device+0x178/0x240 drivers/base/bus.c:537 device_add+0x71c/0xa60 drivers/base/core.c:3689 platform_device_add+0x3e8/0x6dc drivers/base/platform.c:716 platform_device_register_full+0x3bc/0x4bc drivers/base/platform.c:844 vhci_hcd_init+0x194/0x2ac drivers/usb/usbip/vhci_hcd.c:1533 do_one_initcall+0x250/0x990 init/main.c:1269 do_initcall_level+0x128/0x1c4 init/main.c:1331 do_initcalls+0x70/0xd0 init/main.c:1347 do_basic_setup+0x78/0x8c init/main.c:1366 kernel_init_freeable+0x268/0x39c init/main.c:1579 kernel_init+0x24/0x1dc init/main.c:1469 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 The buggy address belongs to the object at ffff0000cda65000 which belongs to the cache kernfs_node_cache of size 176 The buggy address is located 16 bytes to the right of allocated 176-byte region [ffff0000cda65000, ffff0000cda650b0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10da65 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c18b9000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000110011 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000cda64f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000cda65000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000cda65080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 ^ ffff0000cda65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000cda65180: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ================================================================== ERROR: (device loop3): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 ERROR: (device loop3): remounting filesystem as read-only