------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2780:24 index 1621 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 95 Comm: jfsCommit Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 dump_stack+0x1c/0x28 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0xf8/0x148 lib/ubsan.c:347 dbJoin+0x288/0x2c4 fs/jfs/jfs_dmap.c:2780 dbFreeBits+0x458/0xc30 fs/jfs/jfs_dmap.c:2338 dbFreeDmap fs/jfs/jfs_dmap.c:2087 [inline] dbFree+0x2d4/0x5b0 fs/jfs/jfs_dmap.c:409 txFreeMap+0x668/0xb84 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x2e8/0x8e4 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x3a4/0x98c fs/jfs/jfs_txnmgr.c:2733 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 ---[ end trace ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 95 at fs/jfs/jfs_dmap.c:2879 dbAdjTree+0x3a0/0x480 fs/jfs/jfs_dmap.c:2879 Modules linked in: CPU: 1 PID: 95 Comm: jfsCommit Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dbAdjTree+0x3a0/0x480 fs/jfs/jfs_dmap.c:2879 lr : dbAdjTree+0x3a0/0x480 fs/jfs/jfs_dmap.c:2879 sp : ffff800097497950 x29: ffff800097497950 x28: dfff800000000000 x27: 1fffe0001b143c02 x26: dfff800000000000 x25: ffff0000d8a1e676 x24: 0000000000000000 x23: 0000000000000155 x22: 0000000000000656 x21: 0000000000000004 x20: 0000000000000001 x19: ffff0000d8a1e010 x18: ffff800097496f80 x17: 0000000000000000 x16: ffff80008ac972c0 x15: ffff7000123dd7d4 x14: 1ffff000123dd7d4 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff7000123dd7d4 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : ffff0000c4c1da00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800097497258 x4 : ffff80008ed51900 x3 : 0000000000000000 x2 : 0000000000000004 x1 : 0000000000000155 x0 : 0000000000000656 Call trace: dbAdjTree+0x3a0/0x480 fs/jfs/jfs_dmap.c:2879 dbJoin+0x20c/0x2c4 fs/jfs/jfs_dmap.c:2847 dbFreeBits+0x458/0xc30 fs/jfs/jfs_dmap.c:2338 dbFreeDmap fs/jfs/jfs_dmap.c:2087 [inline] dbFree+0x2d4/0x5b0 fs/jfs/jfs_dmap.c:409 txFreeMap+0x668/0xb84 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x2e8/0x8e4 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x3a4/0x98c fs/jfs/jfs_txnmgr.c:2733 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 irq event stamp: 184 hardirqs last enabled at (183): [] __up_console_sem kernel/printk/printk.c:341 [inline] hardirqs last enabled at (183): [] __console_unlock kernel/printk/printk.c:2706 [inline] hardirqs last enabled at (183): [] console_unlock+0x17c/0x3d4 kernel/printk/printk.c:3038 hardirqs last disabled at (184): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:436 softirqs last enabled at (168): [] softirq_handle_end kernel/softirq.c:399 [inline] softirqs last enabled at (168): [] __do_softirq+0xac8/0xce4 kernel/softirq.c:582 softirqs last disabled at (105): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 ---[ end trace 0000000000000000 ]---