loop0: detected capacity change from 0 to 32768 ... Log Wrap ... Log Wrap ... Log Wrap ... mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... netlink: 'syz.0.0': attribute type 58 has an invalid length. netlink: 40 bytes leftover after parsing attributes in process `syz.0.0'. ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2650:28 index -128 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 5382 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00208-g3c21441eeffc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:231 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453 add_missing_indices+0x6a2/0xbc0 fs/jfs/jfs_dtree.c:2650 jfs_readdir+0x1da4/0x3ac0 fs/jfs/jfs_dtree.c:3020 wrap_directory_iterator+0x93/0xe0 fs/readdir.c:65 iterate_dir+0x5ac/0x770 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:403 [inline] __se_sys_getdents64+0xe4/0x260 fs/readdir.c:389 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f45cad8e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f45cbb97038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 00007f45cafb5fa0 RCX: 00007f45cad8e969 RDX: 0000000000000ff2 RSI: 0000200000001f80 RDI: 0000000000000004 RBP: 00007f45cae10ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f45cafb5fa0 R15: 00007ffc3aedb968 ---[ end trace ]---