ERROR: (device loop2): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1
ERROR: (device loop2): remounting filesystem as read-only
ERROR: (device loop2): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3
non-latin1 character 0x3a73 found in JFS file name
mount with iocharset=utf8 to access
==================================================================
BUG: KFENCE: out-of-bounds read in jfs_strfromUCS_le+0x1b1/0x3c0 fs/jfs/jfs_unicode.c:40

Out-of-bounds read at 0xffff88823bf2b0e2 (4322B right of kfence-#148):
 jfs_strfromUCS_le+0x1b1/0x3c0 fs/jfs/jfs_unicode.c:40
 jfs_readdir+0x1790/0x3ae0 fs/jfs/jfs_dtree.c:2987
 wrap_directory_iterator+0x99/0xe0 fs/readdir.c:65
 iterate_dir+0x3a5/0x580 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:410 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

kfence-#148: 0xffff88823bf2a000-0xffff88823bf2a93f, size=2368, cache=jfs_ip

allocated by task 6909 on cpu 1 at 179.201631s (0.643946s ago):
 jfs_alloc_inode+0x28/0x70 fs/jfs/super.c:105
 alloc_inode+0x6a/0x1b0 fs/inode.c:346
 iget_locked+0x106/0x580 fs/inode.c:1445
 jfs_iget+0x24/0x470 fs/jfs/inode.c:29
 jfs_fill_super+0x8ad/0xd80 fs/jfs/super.c:547
 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691
 vfs_get_tree+0x92/0x2b0 fs/super.c:1751
 fc_mount fs/namespace.c:1208 [inline]
 do_new_mount_fc fs/namespace.c:3651 [inline]
 do_new_mount+0x302/0xa10 fs/namespace.c:3727
 do_mount fs/namespace.c:4050 [inline]
 __do_sys_mount fs/namespace.c:4238 [inline]
 __se_sys_mount+0x313/0x410 fs/namespace.c:4215
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5811 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:jfs_strfromUCS_le+0x1b1/0x3c0 fs/jfs/jfs_unicode.c:40
Code: f0 48 ff c8 48 89 44 24 18 4d 89 ec 4d 89 e7 49 c1 ef 03 48 b8 00 00 00 00 00 fc ff df 41 0f b6 04 07 84 c0 0f 85 cf 00 00 00 <45> 0f b7 6c 5d 00 31 ff 44 89 ee e8 7f 92 84 fe 45 85 ed 0f 84 92
RSP: 0018:ffffc90004bcf9e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880323a0000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 000000000000000f R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed101712487b R12: ffff88823bf2b0e2
R13: ffff88823bf2b0e2 R14: 000000000000000f R15: 1ffff110477e561c
FS:  000055555c5a6500(0000) GS:ffff888126cc2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823bf2b0e2 CR3: 0000000023556000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 jfs_readdir+0x1790/0x3ae0 fs/jfs/jfs_dtree.c:2987
 wrap_directory_iterator+0x99/0xe0 fs/readdir.c:65
 iterate_dir+0x3a5/0x580 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:410 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5ad171933
Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 3d f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8
RSP: 002b:00007fffaa0cd388 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 000055555c5c1600 RCX: 00007ff5ad171933
RDX: 0000000000008000 RSI: 000055555c5c1600 RDI: 0000000000000005
RBP: 000055555c5c15d4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffa8
R13: 0000000000000010 R14: 000055555c5c15d0 R15: 00007fffaa0cf640
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	f0 48 ff c8          	lock dec %rax
   4:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
   9:	4d 89 ec             	mov    %r13,%r12
   c:	4d 89 e7             	mov    %r12,%r15
   f:	49 c1 ef 03          	shr    $0x3,%r15
  13:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1a:	fc ff df
  1d:	41 0f b6 04 07       	movzbl (%r15,%rax,1),%eax
  22:	84 c0                	test   %al,%al
  24:	0f 85 cf 00 00 00    	jne    0xf9
* 2a:	45 0f b7 6c 5d 00    	movzwl 0x0(%r13,%rbx,2),%r13d <-- trapping instruction
  30:	31 ff                	xor    %edi,%edi
  32:	44 89 ee             	mov    %r13d,%esi
  35:	e8 7f 92 84 fe       	call   0xfe8492b9
  3a:	45 85 ed             	test   %r13d,%r13d
  3d:	0f                   	.byte 0xf
  3e:	84                   	.byte 0x84
  3f:	92                   	xchg   %eax,%edx