================================================================================ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2317:2 index 2621480 is out of range for type 's64[128]' (aka 'long long[128]') CPU: 1 PID: 343 Comm: kworker/u4:4 Not tainted 5.15.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: writeback wb_workfn (flush-7:0) Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151 __ubsan_handle_out_of_bounds+0xd4/0x108 lib/ubsan.c:282 dbAllocBits+0x874/0x8bc fs/jfs/jfs_dmap.c:2317 dbAllocDmap fs/jfs/jfs_dmap.c:2094 [inline] dbAllocNear+0x25c/0x350 fs/jfs/jfs_dmap.c:1315 dbAlloc+0x760/0x978 fs/jfs/jfs_dmap.c:832 extBalloc fs/jfs/jfs_extent.c:523 [inline] extAlloc+0x3f4/0xdc4 fs/jfs/jfs_extent.c:125 jfs_get_block+0x2bc/0x8ec fs/jfs/inode.c:258 __mpage_writepage+0x390/0x154c fs/mpage.c:564 write_cache_pages+0x7c8/0xde4 mm/page-writeback.c:2277 mpage_writepages+0xe4/0x218 fs/mpage.c:712 jfs_writepages+0x30/0x40 fs/jfs/inode.c:293 do_writepages+0x36c/0x578 mm/page-writeback.c:2386 __writeback_single_inode+0x148/0x11f0 fs/fs-writeback.c:1647 writeback_sb_inodes+0x7fc/0x1378 fs/fs-writeback.c:1930 wb_writeback+0x3d8/0xe44 fs/fs-writeback.c:2104 wb_do_writeback fs/fs-writeback.c:2247 [inline] wb_workfn+0x350/0xdd8 fs/fs-writeback.c:2288 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 ================================================================================ ================================================================== BUG: KASAN: use-after-free in dbAllocBits+0x794/0x8bc fs/jfs/jfs_dmap.c:2317 Read of size 8 at addr ffff0000db397178 by task kworker/u4:4/343 CPU: 1 PID: 343 Comm: kworker/u4:4 Not tainted 5.15.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: writeback wb_workfn (flush-7:0) Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309 dbAllocBits+0x794/0x8bc fs/jfs/jfs_dmap.c:2317 dbAllocDmap fs/jfs/jfs_dmap.c:2094 [inline] dbAllocNear+0x25c/0x350 fs/jfs/jfs_dmap.c:1315 dbAlloc+0x760/0x978 fs/jfs/jfs_dmap.c:832 extBalloc fs/jfs/jfs_extent.c:523 [inline] extAlloc+0x3f4/0xdc4 fs/jfs/jfs_extent.c:125 jfs_get_block+0x2bc/0x8ec fs/jfs/inode.c:258 __mpage_writepage+0x390/0x154c fs/mpage.c:564 write_cache_pages+0x7c8/0xde4 mm/page-writeback.c:2277 mpage_writepages+0xe4/0x218 fs/mpage.c:712 jfs_writepages+0x30/0x40 fs/jfs/inode.c:293 do_writepages+0x36c/0x578 mm/page-writeback.c:2386 __writeback_single_inode+0x148/0x11f0 fs/fs-writeback.c:1647 writeback_sb_inodes+0x7fc/0x1378 fs/fs-writeback.c:1930 wb_writeback+0x3d8/0xe44 fs/fs-writeback.c:2104 wb_do_writeback fs/fs-writeback.c:2247 [inline] wb_workfn+0x350/0xdd8 fs/fs-writeback.c:2288 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 The buggy address belongs to the page: page:0000000006fe88e4 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b397 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffc00036ce588 fffffc00036ce608 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000db397000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000db397080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000db397100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000db397180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000db397200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ================================================================================ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_extent.c:545:16 index 2621480 is out of range for type 'atomic_t[128]' CPU: 1 PID: 343 Comm: kworker/u4:4 Tainted: G B 5.15.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: writeback wb_workfn (flush-7:0) Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151 __ubsan_handle_out_of_bounds+0xd4/0x108 lib/ubsan.c:282 extBalloc fs/jfs/jfs_extent.c:545 [inline] extAlloc+0xc90/0xdc4 fs/jfs/jfs_extent.c:125 jfs_get_block+0x2bc/0x8ec fs/jfs/inode.c:258 __mpage_writepage+0x390/0x154c fs/mpage.c:564 write_cache_pages+0x7c8/0xde4 mm/page-writeback.c:2277 mpage_writepages+0xe4/0x218 fs/mpage.c:712 jfs_writepages+0x30/0x40 fs/jfs/inode.c:293 do_writepages+0x36c/0x578 mm/page-writeback.c:2386 __writeback_single_inode+0x148/0x11f0 fs/fs-writeback.c:1647 writeback_sb_inodes+0x7fc/0x1378 fs/fs-writeback.c:1930 wb_writeback+0x3d8/0xe44 fs/fs-writeback.c:2104 wb_do_writeback fs/fs-writeback.c:2247 [inline] wb_workfn+0x350/0xdd8 fs/fs-writeback.c:2288 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 ================================================================================ attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768 attempt to access beyond end of device loop0: rw=1, want=171801313640, limit=32768