jfs_lookup: dtSearch returned -5 find_entry called with index >= next_index ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1997:37 index -128 is out of range for type 'struct dtslot[128]' CPU: 1 UID: 0 PID: 6529 Comm: syz.3.9 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0xf8/0x148 lib/ubsan.c:429 dtSplitRoot+0x994/0x1424 fs/jfs/jfs_dtree.c:1997 dtSplitUp fs/jfs/jfs_dtree.c:992 [inline] dtInsert+0xf80/0x573c fs/jfs/jfs_dtree.c:870 jfs_mkdir+0x6bc/0xa08 fs/jfs/namei.c:270 vfs_mkdir+0x27c/0x410 fs/namei.c:4311 do_mkdirat+0x248/0x574 fs/namei.c:4334 __do_sys_mkdirat fs/namei.c:4349 [inline] __se_sys_mkdirat fs/namei.c:4347 [inline] __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4347 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 ---[ end trace ]--- ================================================================== BUG: KASAN: slab-use-after-free in dtSplitRoot+0x958/0x1424 fs/jfs/jfs_dtree.c:1998 Read of size 4 at addr ffff0000dc4e701c by task syz.3.9/6529 CPU: 0 UID: 0 PID: 6529 Comm: syz.3.9 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x198/0x538 mm/kasan/report.c:489 kasan_report+0xd8/0x138 mm/kasan/report.c:602 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 dtSplitRoot+0x958/0x1424 fs/jfs/jfs_dtree.c:1998 dtSplitUp fs/jfs/jfs_dtree.c:992 [inline] dtInsert+0xf80/0x573c fs/jfs/jfs_dtree.c:870 jfs_mkdir+0x6bc/0xa08 fs/jfs/namei.c:270 vfs_mkdir+0x27c/0x410 fs/namei.c:4311 do_mkdirat+0x248/0x574 fs/namei.c:4334 __do_sys_mkdirat fs/namei.c:4349 [inline] __se_sys_mkdirat fs/namei.c:4347 [inline] __arm64_sys_mkdirat+0x8c/0xa4 fs/namei.c:4347 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:568 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] kmem_cache_alloc_noprof+0x254/0x410 mm/slub.c:4175 getname_flags+0xcc/0x4b4 fs/namei.c:139 getname+0x24/0x34 fs/namei.c:223 getname_maybe_null include/linux/fs.h:2796 [inline] vfs_fstatat+0x48/0x15c fs/stat.c:361 __do_sys_newfstatat fs/stat.c:530 [inline] __se_sys_newfstatat fs/stat.c:524 [inline] __arm64_sys_newfstatat+0x10c/0x190 fs/stat.c:524 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x64/0x8c mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kmem_cache_free+0x198/0x554 mm/slub.c:4715 putname+0x130/0x184 fs/namei.c:296 vfs_fstatat+0xe8/0x15c fs/stat.c:367 __do_sys_newfstatat fs/stat.c:530 [inline] __se_sys_newfstatat fs/stat.c:524 [inline] __arm64_sys_newfstatat+0x10c/0x190 fs/stat.c:524 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 The buggy address belongs to the object at ffff0000dc4e6600 which belongs to the cache names_cache of size 4096 The buggy address is located 2588 bytes inside of freed 4096-byte region [ffff0000dc4e6600, ffff0000dc4e7600) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c4e0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000040 ffff0000c18958c0 0000000000000000 0000000000000001 raw: 0000000000000000 0000000000070007 00000001f5000000 0000000000000000 head: 05ffc00000000040 ffff0000c18958c0 0000000000000000 0000000000000001 head: 0000000000000000 0000000000070007 00000001f5000000 0000000000000000 head: 05ffc00000000003 fffffdffc3713801 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000dc4e6f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000dc4e6f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000dc4e7000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000dc4e7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000dc4e7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== find_entry called with index = 0 ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... fuse: Bad value for 'rootmode' ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ...