ERROR: (device loop5): dtReadFirst: stbl[0] out of bound ERROR: (device loop5): remounting filesystem as read-only ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:784:21 index -1 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 8313 Comm: syz.5.361 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:455 dtSearch+0x1664/0x1d00 fs/jfs/jfs_dtree.c:784 jfs_lookup+0x13c/0x32c fs/jfs/namei.c:1461 __lookup_slow+0x254/0x378 fs/namei.c:1858 lookup_slow+0x5c/0x80 fs/namei.c:1875 walk_component fs/namei.c:2221 [inline] link_path_walk+0xaf8/0x152c fs/namei.c:2589 path_lookupat+0xc0/0x780 fs/namei.c:2745 filename_lookup+0x1ac/0x454 fs/namei.c:2775 user_path_at+0x50/0x74 fs/namei.c:3567 user_statfs+0x9c/0x188 fs/statfs.c:103 __do_sys_statfs fs/statfs.c:193 [inline] __se_sys_statfs fs/statfs.c:190 [inline] __arm64_sys_statfs+0xc8/0x148 fs/statfs.c:190 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 ---[ end trace ]--- ================================================================== BUG: KASAN: slab-out-of-bounds in addressPXD fs/jfs/jfs_types.h:80 [inline] BUG: KASAN: slab-out-of-bounds in dtSearch+0x1680/0x1d00 fs/jfs/jfs_dtree.c:785 Read of size 4 at addr ffff0000d01a9fe0 by task syz.5.361/8313 CPU: 0 UID: 0 PID: 8313 Comm: syz.5.361 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0xb0/0x110 mm/kasan/report.c:595 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 addressPXD fs/jfs/jfs_types.h:80 [inline] dtSearch+0x1680/0x1d00 fs/jfs/jfs_dtree.c:785 jfs_lookup+0x13c/0x32c fs/jfs/namei.c:1461 __lookup_slow+0x254/0x378 fs/namei.c:1858 lookup_slow+0x5c/0x80 fs/namei.c:1875 walk_component fs/namei.c:2221 [inline] link_path_walk+0xaf8/0x152c fs/namei.c:2589 path_lookupat+0xc0/0x780 fs/namei.c:2745 filename_lookup+0x1ac/0x454 fs/namei.c:2775 user_path_at+0x50/0x74 fs/namei.c:3567 user_statfs+0x9c/0x188 fs/statfs.c:103 __do_sys_statfs fs/statfs.c:193 [inline] __se_sys_statfs fs/statfs.c:190 [inline] __arm64_sys_statfs+0xc8/0x148 fs/statfs.c:190 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Allocated by task 6588: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x344/0x680 mm/slub.c:5270 vm_area_dup+0x34/0x50c mm/vma_init.c:123 dup_mmap+0x740/0x1798 mm/mmap.c:1773 dup_mm kernel/fork.c:1529 [inline] copy_mm+0x100/0x438 kernel/fork.c:1581 copy_process+0x1474/0x32fc kernel/fork.c:2221 kernel_clone+0x1d8/0x84c kernel/fork.c:2651 __do_sys_clone kernel/fork.c:2792 [inline] __se_sys_clone kernel/fork.c:2760 [inline] __arm64_sys_clone+0x144/0x1a0 kernel/fork.c:2760 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Freed by task 8082: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free_after_rcu_debug+0x120/0x2f8 mm/slub.c:6729 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0x848/0x1774 kernel/rcu/tree.c:2857 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2874 handle_softirqs+0x31c/0xc88 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 Last potentially related work creation: kasan_save_stack+0x40/0x6c mm/kasan/common.c:57 kasan_record_aux_stack+0xb0/0xc8 mm/kasan/generic.c:556 slab_free_hook mm/slub.c:2501 [inline] slab_free mm/slub.c:6670 [inline] kmem_cache_free+0x4b4/0x6e4 mm/slub.c:6781 vm_area_free+0x108/0x17c mm/vma_init.c:151 remove_vma+0x120/0x138 mm/vma.c:462 exit_mmap+0x408/0xaac mm/mmap.c:1302 __mmput+0xec/0x3fc kernel/fork.c:1173 mmput+0x70/0xac kernel/fork.c:1196 exit_mm+0x13c/0x200 kernel/exit.c:581 do_exit+0x4c4/0x1a1c kernel/exit.c:959 do_group_exit+0x194/0x22c kernel/exit.c:1112 get_signal+0x11dc/0x12f8 kernel/signal.c:3034 arch_do_signal_or_restart+0x268/0x46d4 arch/arm64/kernel/signal.c:1619 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x88/0x18c kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] exit_to_user_mode_prepare_legacy include/linux/irq-entry-common.h:242 [inline] arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:81 [inline] el0_svc+0x17c/0x26c arch/arm64/kernel/entry-common.c:725 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 The buggy address belongs to the object at ffff0000d01a9dc0 which belongs to the cache vm_area_struct of size 256 The buggy address is located 288 bytes to the right of allocated 256-byte region [ffff0000d01a9dc0, ffff0000d01a9ec0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1101a9 memcg:ffff0000d32bc701 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c18b8b40 dead000000000122 0000000000000000 raw: 0000000000000000 00000000000c000c 00000000f5000000 ffff0000d32bc701 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d01a9e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff0000d01a9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000d01a9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0000d01aa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000d01aa080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ERROR: (device loop5): dtSearch: stack overrun! btstack dump: bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 20, index = 0 bn = 0, index = 0 bn = 0, index = 0 jfs_lookup: dtSearch returned -5