Warning: Permanently added '10.128.1.142' (ED25519) to the list of known hosts. executing program [ 42.478460][ T4023] loop0: detected capacity change from 0 to 32768 [ 42.585301][ T241] BUG: spinlock bad magic on CPU#1, jfsCommit/241 [ 42.587105][ T241] lock: 0xffff0000ddfd9c68, .magic: ffff8000, .owner: @¤ýÝ/0, .owner_cpu: 512 [ 42.589534][ T241] CPU: 1 PID: 241 Comm: jfsCommit Not tainted 5.15.185-syzkaller #0 [ 42.591766][ T241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 42.594501][ T241] Call trace: [ 42.595340][ T241] dump_backtrace+0x0/0x43c [ 42.596589][ T241] show_stack+0x2c/0x3c [ 42.597695][ T241] __dump_stack+0x30/0x40 [ 42.598937][ T241] dump_stack_lvl+0xf8/0x160 [ 42.600208][ T241] dump_stack+0x1c/0x5c [ 42.601311][ T241] spin_dump+0x110/0x208 [ 42.602462][ T241] do_raw_spin_lock+0x1e0/0x2f0 [ 42.603748][ T241] _raw_spin_lock_irqsave+0xcc/0x14c [ 42.605186][ T241] __wake_up+0xe0/0x16c [ 42.606341][ T241] release_metapage+0x17c/0x920 [ 42.607657][ T241] xtTruncate+0xb70/0x2698 [ 42.608873][ T241] jfs_free_zero_link+0x2a4/0x410 [ 42.610206][ T241] jfs_evict_inode+0x2fc/0x3fc [ 42.611481][ T241] evict+0x3c8/0x810 [ 42.612647][ T241] iput+0x6c4/0x77c [ 42.613644][ T241] txUpdateMap+0x6ac/0x7cc [ 42.614851][ T241] jfs_lazycommit+0x384/0x9bc [ 42.616095][ T241] kthread+0x374/0x454 [ 42.617221][ T241] ret_from_fork+0x10/0x20 [ 42.618433][ T241] ================================================================================ [ 42.621013][ T241] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9 [ 42.623273][ T241] index 1112 is out of range for type 'unsigned long[8]' [ 42.625279][ T241] CPU: 1 PID: 241 Comm: jfsCommit Not tainted 5.15.185-syzkaller #0 [ 42.627468][ T241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 42.630279][ T241] Call trace: [ 42.631177][ T241] dump_backtrace+0x0/0x43c [ 42.632381][ T241] show_stack+0x2c/0x3c [ 42.633524][ T241] __dump_stack+0x30/0x40 [ 42.634713][ T241] dump_stack_lvl+0xf8/0x160 [ 42.635939][ T241] dump_stack+0x1c/0x5c [ 42.637058][ T241] ubsan_epilogue+0x14/0x48 [ 42.638287][ T241] __ubsan_handle_out_of_bounds+0xd4/0x108 [ 42.639889][ T241] queued_spin_lock_slowpath+0x724/0x798 [ 42.641378][ T241] do_raw_spin_lock+0x2ec/0x2f0 [ 42.642641][ T241] _raw_spin_lock_irqsave+0xcc/0x14c [ 42.644162][ T241] __wake_up+0xe0/0x16c [ 42.645307][ T241] release_metapage+0x17c/0x920 [ 42.646603][ T241] xtTruncate+0xb70/0x2698 [ 42.647739][ T241] jfs_free_zero_link+0x2a4/0x410 [ 42.649120][ T241] jfs_evict_inode+0x2fc/0x3fc [ 42.650342][ T241] evict+0x3c8/0x810 [ 42.651406][ T241] iput+0x6c4/0x77c [ 42.652461][ T241] txUpdateMap+0x6ac/0x7cc [ 42.653683][ T241] jfs_lazycommit+0x384/0x9bc [ 42.654949][ T241] kthread+0x374/0x454 [ 42.656084][ T241] ret_from_fork+0x10/0x20 [ 42.657277][ T241] ================================================================================ [ 42.659861][ T241] ================================================================== [ 42.662064][ T241] BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x57c/0x798 [ 42.664274][ T241] Write of size 8 at addr ffff0000215971b4 by task jfsCommit/241 [ 42.666361][ T241] [ 42.666952][ T241] CPU: 1 PID: 241 Comm: jfsCommit Not tainted 5.15.185-syzkaller #0 [ 42.669187][ T241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 42.671913][ T241] Call trace: [ 42.672747][ T241] dump_backtrace+0x0/0x43c [ 42.673919][ T241] show_stack+0x2c/0x3c [ 42.675136][ T241] __dump_stack+0x30/0x40 [ 42.676325][ T241] dump_stack_lvl+0xf8/0x160 [ 42.677601][ T241] print_address_description+0x78/0x30c [ 42.679089][ T241] kasan_report+0xec/0x15c [ 42.680324][ T241] __asan_report_store8_noabort+0x44/0x50 [ 42.681858][ T241] queued_spin_lock_slowpath+0x57c/0x798 [ 42.683426][ T241] do_raw_spin_lock+0x2ec/0x2f0 [ 42.684771][ T241] _raw_spin_lock_irqsave+0xcc/0x14c [ 42.686274][ T241] __wake_up+0xe0/0x16c [ 42.687487][ T241] release_metapage+0x17c/0x920 [ 42.688888][ T241] xtTruncate+0xb70/0x2698 [ 42.690081][ T241] jfs_free_zero_link+0x2a4/0x410 [ 42.691462][ T241] jfs_evict_inode+0x2fc/0x3fc [ 42.692738][ T241] evict+0x3c8/0x810 [ 42.693766][ T241] iput+0x6c4/0x77c [ 42.694790][ T241] txUpdateMap+0x6ac/0x7cc [ 42.695991][ T241] jfs_lazycommit+0x384/0x9bc [ 42.697424][ T241] kthread+0x374/0x454 [ 42.698580][ T241] ret_from_fork+0x10/0x20 [ 42.699769][ T241] [ 42.700398][ T241] The buggy address belongs to the page: [ 42.702009][ T241] page:0000000059c3d892 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61597 [ 42.704813][ T241] flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) [ 42.706781][ T241] raw: 01ffc00000000000 fffffc00008565c8 fffffc00008565c8 0000000000000000 [ 42.709080][ T241] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 42.711374][ T241] page dumped because: kasan: bad access detected [ 42.713088][ T241] [ 42.713747][ T241] Memory state around the buggy address: [ 42.715289][ T241] ffff000021597080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.717567][ T241] ffff000021597100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.719831][ T241] >ffff000021597180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.721974][ T241] ^ [ 42.723496][ T241] ffff000021597200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.725737][ T241] ffff000021597280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.727909][ T241] ==================================================================