loop0: detected capacity change from 0 to 32768
 ... Log Wrap ... Log Wrap ... Log Wrap ...
read_mapping_page failed!
ERROR: (device loop0): txCommit: 
==================================================================
BUG: KFENCE: out-of-bounds read in dtSplitPage+0x10f9/0x37c0 fs/jfs/jfs_dtree.c:-1

Out-of-bounds read at 0xffff88805b3ed0bd (2333B right of kfence-#245):
 dtSplitPage+0x10f9/0x37c0 fs/jfs/jfs_dtree.c:-1
 dtSplitUp fs/jfs/jfs_dtree.c:1092 [inline]
 dtInsert+0x10a4/0x5f10 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x783/0xb00 fs/jfs/namei.c:271
 vfs_mkdir+0x413/0x630 fs/namei.c:5261
 filename_mkdirat+0x285/0x510 fs/namei.c:5294
 __do_sys_mkdirat fs/namei.c:5315 [inline]
 __se_sys_mkdirat+0x35/0x150 fs/namei.c:5312
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

kfence-#245: 0xffff88805b3ec7a0-0xffff88805b3ecfff, size=2144, cache=jfs_ip

allocated by task 5326 on cpu 0 at 102.724153s (0.142082s ago):
 jfs_alloc_inode+0x28/0x70 fs/jfs/super.c:105
 alloc_inode+0x6a/0x1b0 fs/inode.c:345
 iget_locked+0x131/0x6a0 fs/inode.c:1474
 jfs_iget+0x24/0x470 fs/jfs/inode.c:29
 jfs_lookup+0x220/0x420 fs/jfs/namei.c:1472
 __lookup_slow+0x2b7/0x410 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 __do_sys_chdir fs/open.c:557 [inline]
 __se_sys_chdir+0xa8/0x2a0 fs/open.c:550
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:dtSplitPage+0x10f9/0x37c0 fs/jfs/jfs_dtree.c:-1
Code: fe 41 c1 e5 05 4c 03 ac 24 c8 00 00 00 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f 85 39 01 00 00 <45> 0f b6 7d 00 4d 85 f6 75 20 e8 38 00 68 fe 41 0f b7 c7 44 69 f8
RSP: 0018:ffffc9000f197580 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: dffffc0000000000
RDX: 0000000000000002 RSI: 0000000000200000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88803277a500 R09: 0000000000000002
R10: 0000000000000004 R11: 0000000000000002 R12: 0000000000000000
R13: ffff88805b3ed0bd R14: 0000000000200000 R15: 0000000000000080
FS:  00007fd9c4a3f6c0(0000) GS:ffff88808c838000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88805b3ed0bd CR3: 0000000011f03000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 dtSplitUp fs/jfs/jfs_dtree.c:1092 [inline]
 dtInsert+0x10a4/0x5f10 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x783/0xb00 fs/jfs/namei.c:271
 vfs_mkdir+0x413/0x630 fs/namei.c:5261
 filename_mkdirat+0x285/0x510 fs/namei.c:5294
 __do_sys_mkdirat fs/namei.c:5315 [inline]
 __se_sys_mkdirat+0x35/0x150 fs/namei.c:5312
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd9c3b9c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd9c4a3efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fd9c3e15fa0 RCX: 00007fd9c3b9c819
RDX: 0000000000000000 RSI: 0000200000000340 RDI: ffffffffffffff9c
RBP: 00007fd9c3c32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd9c3e16038 R14: 00007fd9c3e15fa0 R15: 00007fff52707708
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	fe 41 c1             	incb   -0x3f(%rcx)
   3:	e5 05                	in     $0x5,%eax
   5:	4c 03 ac 24 c8 00 00 	add    0xc8(%rsp),%r13
   c:	00
   d:	4c 89 e8             	mov    %r13,%rax
  10:	48 c1 e8 03          	shr    $0x3,%rax
  14:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  1b:	fc ff df
  1e:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax
  22:	84 c0                	test   %al,%al
  24:	0f 85 39 01 00 00    	jne    0x163
* 2a:	45 0f b6 7d 00       	movzbl 0x0(%r13),%r15d <-- trapping instruction
  2f:	4d 85 f6             	test   %r14,%r14
  32:	75 20                	jne    0x54
  34:	e8 38 00 68 fe       	call   0xfe680071
  39:	41 0f b7 c7          	movzwl %r15w,%eax
  3d:	44                   	rex.R
  3e:	69                   	.byte 0x69
  3f:	f8                   	clc