ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 ERROR: (device loop0): remounting filesystem as read-only ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2894:30 index -128 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 7121 Comm: syz.0.118 Not tainted 6.12.0-syzkaller-g7b1d1d4cfac0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:484 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0xf8/0x148 lib/ubsan.c:429 jfs_readdir+0x1580/0x37bc fs/jfs/jfs_dtree.c:2894 wrap_directory_iterator+0xa8/0xf4 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x408/0x648 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:407 [inline] __se_sys_getdents64 fs/readdir.c:392 [inline] __arm64_sys_getdents64+0x1c4/0x48c fs/readdir.c:392 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 ---[ end trace ]--- ================================================================== BUG: KASAN: slab-out-of-bounds in jfs_readdir+0x1484/0x37bc fs/jfs/jfs_dtree.c:2896 Read of size 1 at addr ffff0000f11b7c2d by task syz.0.118/7121 CPU: 0 UID: 0 PID: 7121 Comm: syz.0.118 Not tainted 6.12.0-syzkaller-g7b1d1d4cfac0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:484 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x198/0x538 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 jfs_readdir+0x1484/0x37bc fs/jfs/jfs_dtree.c:2896 wrap_directory_iterator+0xa8/0xf4 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x408/0x648 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:407 [inline] __se_sys_getdents64 fs/readdir.c:392 [inline] __arm64_sys_getdents64+0x1c4/0x48c fs/readdir.c:392 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 6860: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_noprof+0x2d4/0x4dc mm/slub.c:4270 __kvmalloc_node_noprof+0x88/0x24c mm/util.c:658 btree_node_data_alloc+0x11c/0x21c fs/bcachefs/btree_cache.c:157 __bch2_btree_node_mem_alloc+0x194/0x36c fs/bcachefs/btree_cache.c:198 bch2_fs_btree_cache_init+0x264/0x5ac fs/bcachefs/btree_cache.c:653 bch2_fs_alloc fs/bcachefs/super.c:917 [inline] bch2_fs_open+0x23c8/0x27c4 fs/bcachefs/super.c:2065 bch2_fs_get_tree+0x53c/0x1030 fs/bcachefs/fs.c:2157 vfs_get_tree+0x90/0x28c fs/super.c:1814 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x4d4/0x5ac fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6860: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x64/0x8c mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x184/0x47c mm/slub.c:4727 kvfree+0x40/0x50 mm/util.c:701 __btree_node_data_free+0x280/0x48c fs/bcachefs/btree_cache.c:113 btree_node_data_free fs/bcachefs/btree_cache.c:127 [inline] bch2_fs_btree_cache_exit+0x900/0x123c fs/bcachefs/btree_cache.c:610 __bch2_fs_free fs/bcachefs/super.c:557 [inline] bch2_fs_release+0x204/0x728 fs/bcachefs/super.c:611 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:737 bch2_fs_free+0x2c4/0x334 fs/bcachefs/super.c:673 bch2_fs_stop+0x28/0x38 fs/bcachefs/super.c:679 bch2_fs_get_tree+0xab0/0x1030 fs/bcachefs/fs.c:2265 vfs_get_tree+0x90/0x28c fs/super.c:1814 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x4d4/0x5ac fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 The buggy address belongs to the object at ffff0000f11b6000 which belongs to the cache kmalloc-rcl-4k of size 4096 The buggy address is located 3117 bytes to the right of allocated 4096-byte region [ffff0000f11b6000, ffff0000f11b7000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1311b0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff0000d2c3bb01 flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000040 ffff0000c000c280 fffffdffc3c4a200 dead000000000002 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff0000d2c3bb01 head: 05ffc00000000040 ffff0000c000c280 fffffdffc3c4a200 dead000000000002 head: 0000000000000000 0000000000040004 00000001f5000000 ffff0000d2c3bb01 head: 05ffc00000000003 fffffdffc3c46c01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000f11b7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000f11b7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000f11b7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0000f11b7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000f11b7d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:2649:28 index -128 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 7121 Comm: syz.0.118 Tainted: G B 6.12.0-syzkaller-g7b1d1d4cfac0 #0 Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:484 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0xf8/0x148 lib/ubsan.c:429 add_missing_indices fs/jfs/jfs_dtree.c:2649 [inline] jfs_readdir+0x1dfc/0x37bc fs/jfs/jfs_dtree.c:3011 wrap_directory_iterator+0xa8/0xf4 fs/readdir.c:65 shared_jfs_readdir+0x30/0x40 fs/jfs/namei.c:1540 iterate_dir+0x408/0x648 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:407 [inline] __se_sys_getdents64 fs/readdir.c:392 [inline] __arm64_sys_getdents64+0x1c4/0x48c fs/readdir.c:392 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 ---[ end trace ]--- ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1 non-latin1 character 0x3ff found in JFS file name mount with iocharset=utf8 to access