jfs_lookup: dtSearch returned -5
find_entry called with index >= next_index
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1998:37
index -128 is out of range for type 'struct dtslot[128]'
CPU: 0 UID: 0 PID: 6675 Comm: syz.0.8 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:455
 dtSplitRoot+0x87c/0x12f4 fs/jfs/jfs_dtree.c:1998
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x5a4/0x8b4 fs/jfs/namei.c:270
 vfs_mkdir+0x284/0x424 fs/namei.c:4366
 do_mkdirat+0x1f8/0x4c8 fs/namei.c:4399
 __do_sys_mkdirat fs/namei.c:4416 [inline]
 __se_sys_mkdirat fs/namei.c:4414 [inline]
 __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4414
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
---[ end trace ]---
==================================================================
BUG: KASAN: use-after-free in dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999
Read of size 4 at addr ffff0000d5b0501c by task syz.0.8/6675

CPU: 0 UID: 0 PID: 6675 Comm: syz.0.8 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
 dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x5a4/0x8b4 fs/jfs/namei.c:270
 vfs_mkdir+0x284/0x424 fs/namei.c:4366
 do_mkdirat+0x1f8/0x4c8 fs/namei.c:4399
 __do_sys_mkdirat fs/namei.c:4416 [inline]
 __se_sys_mkdirat fs/namei.c:4414 [inline]
 __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4414
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d5b05fc0 pfn:0x115b05
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffdffc355b308 fffffdffc37b8d08 0000000000000000
raw: ffff0000d5b05fc0 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d5b04f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000d5b04f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000d5b05000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000d5b05080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5b05100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
find_entry called with index >= next_index

 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...