loop1: detected capacity change from 0 to 32768 ================================================================== BUG: KFENCE: out-of-bounds read in dtCompare fs/jfs/jfs_dtree.c:3317 [inline] BUG: KFENCE: out-of-bounds read in dtSearch+0x82a/0x2520 fs/jfs/jfs_dtree.c:649 Out-of-bounds read at 0xffff88823bd67218 (4632B right of kfence-#178): dtCompare fs/jfs/jfs_dtree.c:3317 [inline] dtSearch+0x82a/0x2520 fs/jfs/jfs_dtree.c:649 jfs_lookup+0x17f/0x410 fs/jfs/namei.c:1461 __lookup_slow+0x28c/0x3f0 fs/namei.c:1718 lookup_slow+0x53/0x70 fs/namei.c:1735 walk_component+0x2e1/0x410 fs/namei.c:2039 lookup_last fs/namei.c:2542 [inline] path_lookupat+0x16f/0x450 fs/namei.c:2566 filename_lookup+0x256/0x610 fs/namei.c:2595 user_path_at+0x3a/0x60 fs/namei.c:3002 do_mount fs/namespace.c:3809 [inline] __do_sys_mount fs/namespace.c:4020 [inline] __se_sys_mount+0x297/0x3c0 fs/namespace.c:3997 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#178: 0xffff88823bd66000-0xffff88823bd668b7, size=2232, cache=jfs_ip allocated by task 13880 on cpu 1 at 677.203091s: jfs_alloc_inode+0x28/0x70 fs/jfs/super.c:105 alloc_inode fs/inode.c:263 [inline] iget_locked+0x193/0x820 fs/inode.c:1342 jfs_iget+0x22/0x3b0 fs/jfs/inode.c:29 jfs_fill_super+0x808/0xc50 fs/jfs/super.c:580 mount_bdev+0x20a/0x2d0 fs/super.c:1679 legacy_get_tree+0xee/0x190 fs/fs_context.c:662 vfs_get_tree+0x90/0x2a0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3472 do_mount fs/namespace.c:3812 [inline] __do_sys_mount fs/namespace.c:4020 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 13880 Comm: syz.1.730 Not tainted 6.11.0-rc2-syzkaller-00111-gee9a43b7cfe2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:dtCompare fs/jfs/jfs_dtree.c:3317 [inline] RIP: 0010:dtSearch+0x82a/0x2520 fs/jfs/jfs_dtree.c:649 Code: 2c 06 48 89 44 24 20 49 8d 7c 06 08 48 89 f8 48 c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30 84 c0 0f 85 28 0e 00 00 <0f> b6 45 08 88 44 24 58 48 8d 5d 09 48 89 d8 48 c1 e8 03 42 0f b6 RSP: 0018:ffffc900041d7678 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff110477acc60 RDX: ffff88807d6eda00 RSI: 0000000000000000 RDI: ffff88823bd67218 RBP: ffff88823bd67210 R08: ffffffff8321e06f R09: 000000000000000e R10: dffffc0000000000 R11: fffffbfff1fed366 R12: dffffc0000000000 R13: ffff88807c602800 R14: dffffc0000000000 R15: ffff88823bd66308 FS: 00007f874ebaa6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bd67218 CR3: 0000000067c7c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: jfs_lookup+0x17f/0x410 fs/jfs/namei.c:1461 __lookup_slow+0x28c/0x3f0 fs/namei.c:1718 lookup_slow+0x53/0x70 fs/namei.c:1735 walk_component+0x2e1/0x410 fs/namei.c:2039 lookup_last fs/namei.c:2542 [inline] path_lookupat+0x16f/0x450 fs/namei.c:2566 filename_lookup+0x256/0x610 fs/namei.c:2595 user_path_at+0x3a/0x60 fs/namei.c:3002 do_mount fs/namespace.c:3809 [inline] __do_sys_mount fs/namespace.c:4020 [inline] __se_sys_mount+0x297/0x3c0 fs/namespace.c:3997 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f874dd779f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f874ebaa038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f874df05f80 RCX: 00007f874dd779f9 RDX: 0000000020000100 RSI: 0000000020000040 RDI: 0000000020000000 RBP: 00007f874dde58ee R08: 00000000200001c0 R09: 0000000000000000 R10: 0000000000190000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f874df05f80 R15: 00007ffe069a8dd8 ================================================================== ---------------- Code disassembly (best guess): 0: 2c 06 sub $0x6,%al 2: 48 89 44 24 20 mov %rax,0x20(%rsp) 7: 49 8d 7c 06 08 lea 0x8(%r14,%rax,1),%rdi c: 48 89 f8 mov %rdi,%rax f: 48 c1 e8 03 shr $0x3,%rax 13: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 1a: fc ff df 1d: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax 22: 84 c0 test %al,%al 24: 0f 85 28 0e 00 00 jne 0xe52 * 2a: 0f b6 45 08 movzbl 0x8(%rbp),%eax <-- trapping instruction 2e: 88 44 24 58 mov %al,0x58(%rsp) 32: 48 8d 5d 09 lea 0x9(%rbp),%rbx 36: 48 89 d8 mov %rbx,%rax 39: 48 c1 e8 03 shr $0x3,%rax 3d: 42 rex.X 3e: 0f .byte 0xf 3f: b6 .byte 0xb6