... Log Wrap ... Log Wrap ... Log Wrap ... find_entry called with index >= next_index ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1998:37 index -128 is out of range for type 'struct dtslot[128]' CPU: 1 UID: 0 PID: 8814 Comm: syz.8.464 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:455 dtSplitRoot+0x87c/0x12f4 fs/jfs/jfs_dtree.c:1998 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline] dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871 jfs_create+0x588/0x8c4 fs/jfs/namei.c:137 lookup_open fs/namei.c:3796 [inline] open_last_lookups fs/namei.c:3895 [inline] path_openat+0x12d8/0x2c40 fs/namei.c:4131 do_filp_open+0x18c/0x36c fs/namei.c:4161 do_sys_openat2+0x11c/0x1b4 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __arm64_sys_openat+0x120/0x158 fs/open.c:1463 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 ---[ end trace ]--- ================================================================== BUG: KASAN: slab-use-after-free in dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999 Read of size 4 at addr ffff0000fc76001c by task syz.8.464/8814 CPU: 1 UID: 0 PID: 8814 Comm: syz.8.464 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0xb0/0x110 mm/kasan/report.c:595 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 dtSplitRoot+0x898/0x12f4 fs/jfs/jfs_dtree.c:1999 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline] dtInsert+0xba0/0x49c0 fs/jfs/jfs_dtree.c:871 jfs_create+0x588/0x8c4 fs/jfs/namei.c:137 lookup_open fs/namei.c:3796 [inline] open_last_lookups fs/namei.c:3895 [inline] path_openat+0x12d8/0x2c40 fs/namei.c:4131 do_filp_open+0x18c/0x36c fs/namei.c:4161 do_sys_openat2+0x11c/0x1b4 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __arm64_sys_openat+0x120/0x158 fs/open.c:1463 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Allocated by task 8723: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:77 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:573 unpoison_slab_object mm/kasan/common.c:342 [inline] __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:368 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4978 [inline] kmem_cache_alloc_bulk_noprof+0x308/0x4dc mm/slub.c:7497 __io_alloc_req_refill+0xa8/0x2cc io_uring/io_uring.c:1056 io_alloc_req io_uring/io_uring.h:543 [inline] io_submit_sqes+0x9e4/0x1a28 io_uring/io_uring.c:2436 __do_sys_io_uring_enter io_uring/io_uring.c:3514 [inline] __se_sys_io_uring_enter io_uring/io_uring.c:3453 [inline] __arm64_sys_io_uring_enter+0x2d8/0x11b8 io_uring/io_uring.c:3453 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Freed by task 10: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:77 __kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2543 [inline] slab_free_after_rcu_debug+0x120/0x2f8 mm/slub.c:6700 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0x840/0x17d0 kernel/rcu/tree.c:2861 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2878 handle_softirqs+0x328/0xc88 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 Last potentially related work creation: kasan_save_stack+0x40/0x6c mm/kasan/common.c:56 kasan_record_aux_stack+0xb0/0xc8 mm/kasan/generic.c:559 slab_free_hook mm/slub.c:2504 [inline] slab_free mm/slub.c:6642 [inline] kmem_cache_free+0x4a8/0x6dc mm/slub.c:6752 __io_req_caches_free+0x194/0x23c io_uring/io_uring.c:2824 io_req_caches_free+0x2c/0x6c io_uring/io_uring.c:2836 io_ring_exit_work+0x38c/0x7d8 io_uring/io_uring.c:3034 process_one_work+0x7e8/0x155c kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3427 kthread+0x5fc/0x75c kernel/kthread.c:463 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 The buggy address belongs to the object at ffff0000fc760000 which belongs to the cache io_kiocb of size 248 The buggy address is located 28 bytes inside of freed 248-byte region [ffff0000fc760000, ffff0000fc7600f8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13c760 memcg:ffff0000f9daa901 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c4a2f280 dead000000000122 0000000000000000 raw: 0000000000000000 00000000000c000c 00000000f5000000 ffff0000f9daa901 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000fc75ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000fc75ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000fc760000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000fc760080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc ffff0000fc760100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ================================================================== find_entry called with index = 0 find_entry called with index = 0 find_entry called with index >= next_index ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ...