==================================================================
BUG: KASAN: slab-out-of-bounds in diWrite+0x928/0x11f0 fs/jfs/jfs_imap.c:753
Write of size 32 at addr ffff0001011494e0 by task syz.2.273/5691

CPU: 0 PID: 5691 Comm: syz.2.273 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0x100 mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x260/0x2a0 mm/kasan/generic.c:189
 memcpy+0x60/0x90 mm/kasan/shadow.c:66
 diWrite+0x928/0x11f0 fs/jfs/jfs_imap.c:753
 txCommit+0x5d0/0x3bec fs/jfs/jfs_txnmgr.c:1255
 add_missing_indices+0x6e0/0x9f8 fs/jfs/jfs_dtree.c:2664
 jfs_readdir+0x184c/0x3148 fs/jfs/jfs_dtree.c:3020
 iterate_dir+0x1f0/0x4cc fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x318 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 5598:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x43c mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x234/0x318 mm/slub.c:3383
 skb_clone+0x194/0x308 net/core/skbuff.c:1660
 dev_queue_xmit_nit+0x210/0x9a4 net/core/dev.c:2321
 xmit_one net/core/dev.c:3666 [inline]
 dev_hard_start_xmit+0x108/0x8e0 net/core/dev.c:3686
 sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3907 [inline]
 __dev_queue_xmit+0x1384/0x309c net/core/dev.c:4312
 dev_queue_xmit include/linux/netdevice.h:3051 [inline]
 neigh_hh_output include/net/neighbour.h:529 [inline]
 neigh_output include/net/neighbour.h:543 [inline]
 ip_finish_output2+0xb9c/0x10a4 net/ipv4/ip_output.c:228
 __ip_finish_output+0x1b0/0x448 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x268 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x314/0x414 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:453 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xcb0/0x16d8 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x7c net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x17c4/0x2b6c net/ipv4/tcp_output.c:1405
 __tcp_send_ack+0x23c/0x4e8 net/ipv4/tcp_output.c:4048
 tcp_send_ack+0x4c/0x68 net/ipv4/tcp_output.c:4054
 __tcp_ack_snd_check+0x3b4/0x848 net/ipv4/tcp_input.c:5626
 tcp_ack_snd_check net/ipv4/tcp_input.c:5672 [inline]
 tcp_rcv_established+0xdb4/0x1d08 net/ipv4/tcp_input.c:6116
 tcp_v4_do_rcv+0x38c/0xa7c net/ipv4/tcp_ipv4.c:1683
 tcp_v4_rcv+0x1eb8/0x2464 net/ipv4/tcp_ipv4.c:2114
 ip_protocol_deliver_rcu+0x350/0x77c net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x250/0x48c net/ipv4/ip_input.c:233
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:463 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline]
 ip_sublist_rcv+0x8a4/0xb6c net/ipv4/ip_input.c:639
 ip_list_rcv+0x398/0x3ec net/ipv4/ip_input.c:674
 __netif_receive_skb_list_ptype net/core/dev.c:5624 [inline]
 __netif_receive_skb_list_core+0x4e4/0x67c net/core/dev.c:5672
 __netif_receive_skb_list net/core/dev.c:5724 [inline]
 netif_receive_skb_list_internal+0x6f4/0x98c net/core/dev.c:5815
 gro_normal_list include/net/gro.h:433 [inline]
 napi_complete_done+0x258/0x60c net/core/dev.c:6156
 gve_napi_poll_dqo+0x120/0x1c4 drivers/net/ethernet/google/gve/gve_main.c:260
 __napi_poll+0xb4/0x3f0 net/core/dev.c:6590
 napi_poll net/core/dev.c:6657 [inline]
 net_rx_action+0x50c/0xb10 net/core/dev.c:6771
 handle_softirqs+0x318/0xc6c kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630

Freed by task 5598:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
 ____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 kmem_cache_free+0x11c/0x324 mm/slub.c:3709
 kfree_skbmem+0x10c/0x19c net/core/skbuff.c:-1
 __kfree_skb net/core/skbuff.c:871 [inline]
 consume_skb+0xa8/0x104 net/core/skbuff.c:1035
 packet_rcv+0x130/0x1114 net/packet/af_packet.c:2280
 dev_queue_xmit_nit+0x92c/0x9a4 net/core/dev.c:2353
 xmit_one net/core/dev.c:3666 [inline]
 dev_hard_start_xmit+0x108/0x8e0 net/core/dev.c:3686
 sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3907 [inline]
 __dev_queue_xmit+0x1384/0x309c net/core/dev.c:4312
 dev_queue_xmit include/linux/netdevice.h:3051 [inline]
 neigh_hh_output include/net/neighbour.h:529 [inline]
 neigh_output include/net/neighbour.h:543 [inline]
 ip_finish_output2+0xb9c/0x10a4 net/ipv4/ip_output.c:228
 __ip_finish_output+0x1b0/0x448 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x268 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x314/0x414 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:453 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xcb0/0x16d8 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x7c net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x17c4/0x2b6c net/ipv4/tcp_output.c:1405
 __tcp_send_ack+0x23c/0x4e8 net/ipv4/tcp_output.c:4048
 tcp_send_ack+0x4c/0x68 net/ipv4/tcp_output.c:4054
 __tcp_ack_snd_check+0x3b4/0x848 net/ipv4/tcp_input.c:5626
 tcp_ack_snd_check net/ipv4/tcp_input.c:5672 [inline]
 tcp_rcv_established+0xdb4/0x1d08 net/ipv4/tcp_input.c:6116
 tcp_v4_do_rcv+0x38c/0xa7c net/ipv4/tcp_ipv4.c:1683
 tcp_v4_rcv+0x1eb8/0x2464 net/ipv4/tcp_ipv4.c:2114
 ip_protocol_deliver_rcu+0x350/0x77c net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x250/0x48c net/ipv4/ip_input.c:233
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:463 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline]
 ip_sublist_rcv+0x8a4/0xb6c net/ipv4/ip_input.c:639
 ip_list_rcv+0x398/0x3ec net/ipv4/ip_input.c:674
 __netif_receive_skb_list_ptype net/core/dev.c:5624 [inline]
 __netif_receive_skb_list_core+0x4e4/0x67c net/core/dev.c:5672
 __netif_receive_skb_list net/core/dev.c:5724 [inline]
 netif_receive_skb_list_internal+0x6f4/0x98c net/core/dev.c:5815
 gro_normal_list include/net/gro.h:433 [inline]
 napi_complete_done+0x258/0x60c net/core/dev.c:6156
 gve_napi_poll_dqo+0x120/0x1c4 drivers/net/ethernet/google/gve/gve_main.c:260
 __napi_poll+0xb4/0x3f0 net/core/dev.c:6590
 napi_poll net/core/dev.c:6657 [inline]
 net_rx_action+0x50c/0xb10 net/core/dev.c:6771
 handle_softirqs+0x318/0xc6c kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630

The buggy address belongs to the object at ffff0001011493c0
 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 48 bytes to the right of
 240-byte region [ffff0001011493c0, ffff0001011494b0)

The buggy address belongs to the physical page:
page:00000000722de360 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x141149
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c086c180
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000101149380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
 ffff000101149400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff000101149480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
                                                       ^
 ffff000101149500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff000101149580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================

 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...


 ... Log Wrap ... Log Wrap ... Log Wrap ...

ERROR: (device loop2): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0

ERROR: (device loop2): remounting filesystem as read-only
JFS: Invalid stbl[1] = -128 for inode 2, block = 0