syzbot

ERROR: (device loop0): dbAlloc: the hint is outside the map
syz-executor325[5814]: segfault at 0 ip 00007fab5b0fc21e sp 00007fffa9183438 error 4 in syz-executor325177815[3921e,7fab5b0cc000+7f000] likely on CPU 1 (core 0, socket 0)
Code: fd d7 c9 0f bc d1 c5 fe 7f 27 c5 fe 7f 6f 20 c5 fe 7f 77 40 c5 fe 7f 7f 60 49 83 c0 1f 49 29 d0 48 8d 7c 17 61 e9 d2 04 00 00 <c5> fe 6f 1e c5 fe 6f 56 20 c5 fd 74 cb c5 fd d7 d1 49 83 f8 21 0f
------------[ cut here ]------------
kernel BUG at fs/jfs/inode.c:169!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5814 Comm: syz-executor325 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:jfs_evict_inode+0x438/0x440 fs/jfs/inode.c:169
Code: fe e9 e0 fd ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 17 fe ff ff 4c 89 f7 e8 a3 26 ec fe e9 0a fe ff ff e8 69 57 8c fe 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000408f720 EFLAGS: 00010293
RAX: ffffffff83336677 RBX: ffff88807ae6b248 RCX: ffff88802c59da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807ae6b248
RBP: 0000000000000001 R08: ffffffff8f7d9f77 R09: 1ffffffff1efb3ee
R10: dffffc0000000000 R11: ffffffff83334410 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88807ae6aed0 R15: ffffffff83336240
FS:  0000000000000000(0000) GS:ffff888126102000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564abdb49e98 CR3: 0000000031490000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 evict+0x501/0x9c0 fs/inode.c:810
 dispose_list fs/inode.c:852 [inline]
 evict_inodes+0x636/0x6c0 fs/inode.c:906
 generic_shutdown_super+0x9a/0x2c0 fs/super.c:627
 kill_block_super+0x44/0x90 fs/super.c:1710
 deactivate_locked_super+0xb9/0x130 fs/super.c:473
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1435
 task_work_run+0x1d1/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x8d6/0x2550 kernel/exit.c:953
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
 get_signal+0x125e/0x1310 kernel/signal.c:3034
 arch_do_signal_or_restart+0x95/0x780 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:231
 exc_page_fault+0x91/0x110 arch/x86/mm/fault.c:1541
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fab5b0fc21e
Code: Unable to access opcode bytes at 0x7fab5b0fc1f4.
RSP: 002b:00007fffa9183438 EFLAGS: 00010287
RAX: 00007fffa91834d0 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007fffa91834d0
RBP: 00002000000079c0 R08: 00000000000000e0 R09: 0000000000000000
R10: 0000000000005412 R11: 0000000000000246 R12: 0000200000007a00
R13: 00007fffa91834d0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_evict_inode+0x438/0x440 fs/jfs/inode.c:169
Code: fe e9 e0 fd ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 17 fe ff ff 4c 89 f7 e8 a3 26 ec fe e9 0a fe ff ff e8 69 57 8c fe 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000408f720 EFLAGS: 00010293
RAX: ffffffff83336677 RBX: ffff88807ae6b248 RCX: ffff88802c59da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807ae6b248
RBP: 0000000000000001 R08: ffffffff8f7d9f77 R09: 1ffffffff1efb3ee
R10: dffffc0000000000 R11: ffffffff83334410 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88807ae6aed0 R15: ffffffff83336240
FS:  0000000000000000(0000) GS:ffff888126102000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564abdb49e98 CR3: 0000000031490000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	fd                   	std
   1:	d7                   	xlat   %ds:(%rbx)
   2:	c9                   	leave
   3:	0f bc d1             	bsf    %ecx,%edx
   6:	c5 fe 7f 27          	vmovdqu %ymm4,(%rdi)
   a:	c5 fe 7f 6f 20       	vmovdqu %ymm5,0x20(%rdi)
   f:	c5 fe 7f 77 40       	vmovdqu %ymm6,0x40(%rdi)
  14:	c5 fe 7f 7f 60       	vmovdqu %ymm7,0x60(%rdi)
  19:	49 83 c0 1f          	add    $0x1f,%r8
  1d:	49 29 d0             	sub    %rdx,%r8
  20:	48 8d 7c 17 61       	lea    0x61(%rdi,%rdx,1),%rdi
  25:	e9 d2 04 00 00       	jmp    0x4fc
* 2a:	c5 fe 6f 1e          	vmovdqu (%rsi),%ymm3 <-- trapping instruction
  2e:	c5 fe 6f 56 20       	vmovdqu 0x20(%rsi),%ymm2
  33:	c5 fd 74 cb          	vpcmpeqb %ymm3,%ymm0,%ymm1
  37:	c5 fd d7 d1          	vpmovmskb %ymm1,%edx
  3b:	49 83 f8 21          	cmp    $0x21,%r8
  3f:	0f                   	.byte 0xf