loop0: detected capacity change from 0 to 32768 ================================================================== BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753 Write of size 32 at addr ffff0000cb90a0c0 by task syz-executor209/4292 CPU: 1 PID: 4292 Comm: syz-executor209 Not tainted 6.1.128-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:427 kasan_report+0xd4/0x130 mm/kasan/report.c:531 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memcpy+0x60/0x90 mm/kasan/shadow.c:66 diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753 txCommit+0x750/0x5574 fs/jfs/jfs_txnmgr.c:1255 add_missing_indices+0x760/0xa8c fs/jfs/jfs_dtree.c:2663 jfs_readdir+0x18ac/0x3030 fs/jfs/jfs_dtree.c:3019 iterate_dir+0x1f4/0x4ec __do_sys_getdents64 fs/readdir.c:369 [inline] __se_sys_getdents64 fs/readdir.c:354 [inline] __arm64_sys_getdents64+0x1c4/0x4a0 fs/readdir.c:354 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Allocated by task 4291: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x74/0x458 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x230/0x37c mm/slub.c:3422 vm_area_alloc+0x2c/0xe0 kernel/fork.c:459 __mmap_region mm/mmap.c:2741 [inline] mmap_region+0x1118/0x2208 mm/mmap.c:2904 do_mmap+0x9ac/0x110c mm/mmap.c:1424 vm_mmap_pgoff+0x1a4/0x2b4 mm/util.c:520 vm_mmap+0x90/0xbc mm/util.c:539 elf_map+0xec/0x220 fs/binfmt_elf.c:390 load_elf_binary+0xc98/0x1d98 fs/binfmt_elf.c:1167 search_binary_handler fs/exec.c:1741 [inline] exec_binprm fs/exec.c:1782 [inline] bprm_execve+0x818/0x162c fs/exec.c:1851 do_execveat_common+0x668/0x814 fs/exec.c:1956 do_execve fs/exec.c:2030 [inline] __do_sys_execve fs/exec.c:2106 [inline] __se_sys_execve fs/exec.c:2101 [inline] __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Freed by task 4291: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] kmem_cache_free+0x2f0/0x588 mm/slub.c:3683 vm_area_free+0x58/0x12c kernel/fork.c:486 remove_vma mm/mmap.c:143 [inline] exit_mmap+0x40c/0xa0c mm/mmap.c:3260 __mmput+0xec/0x39c kernel/fork.c:1200 mmput+0x70/0xac kernel/fork.c:1222 exec_mmap+0x404/0x484 fs/exec.c:1040 begin_new_exec+0x6c8/0xf04 fs/exec.c:1299 load_elf_binary+0x748/0x1d98 fs/binfmt_elf.c:1002 search_binary_handler fs/exec.c:1741 [inline] exec_binprm fs/exec.c:1782 [inline] bprm_execve+0x818/0x162c fs/exec.c:1851 do_execveat_common+0x668/0x814 fs/exec.c:1956 do_execve fs/exec.c:2030 [inline] __do_sys_execve fs/exec.c:2106 [inline] __se_sys_execve fs/exec.c:2101 [inline] __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the object at ffff0000cb90a000 which belongs to the cache vm_area_struct of size 152 The buggy address is located 40 bytes to the right of 152-byte region [ffff0000cb90a000, ffff0000cb90a098) The buggy address belongs to the physical page: page:0000000010b2216d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b90a flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0851680 raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000cb909f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000cb90a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000cb90a080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb ^ ffff0000cb90a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff0000cb90a180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb ================================================================== ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 ERROR: (device loop0): remounting filesystem as read-only