blkno = 0, nblocks = 40
ERROR: (device loop4): dbFree: block to be freed is outside the map
BUG at fs/jfs/jfs_dmap.c:3036 assert(bitno < 32)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_dmap.c:3036!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5771 Comm: syz.4.349 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : dbFindBits+0x1ac/0x1b0 fs/jfs/jfs_dmap.c:3036
lr : dbFindBits+0x1ac/0x1b0 fs/jfs/jfs_dmap.c:3036
sp : ffff800021367010
x29: ffff800021367010 x28: ffff0000db281021 x27: dfff800000000000
x26: 0000000000000000 x25: ffff0000db281804 x24: 0000000000000000
x23: ffff80001593ec70 x22: 0000000000000020 x21: 0000000000000001
x20: 00000000ffffffff x19: 0000000000000000 x18: 000000000004fffe
x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000002
x14: 0000000000000001 x13: 1ffff0000426cd68 x12: 0000000000080000
x11: 00000000000056d3 x10: ffff80002c4ba000 x9 : 4d31515ae121b000
x8 : 4d31515ae121b000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021366ad8 x4 : ffff800015464e80 x3 : ffff80000a927f5c
x2 : ffff00019f393d10 x1 : 0000000100000000 x0 : 0000000000000030
Call trace:
 dbFindBits+0x1ac/0x1b0 fs/jfs/jfs_dmap.c:3036
 dbAllocDmapLev+0x140/0x348 fs/jfs/jfs_dmap.c:1985
 dbAllocCtl+0x128/0x8c0 fs/jfs/jfs_dmap.c:1825
 dbAllocAG+0x1bc/0xe24 fs/jfs/jfs_dmap.c:1353
 dbAlloc+0x42c/0x9dc fs/jfs/jfs_dmap.c:877
 dtSplitUp fs/jfs/jfs_dtree.c:982 [inline]
 dtInsert+0x870/0x5710 fs/jfs/jfs_dtree.c:871
 jfs_create+0x5d0/0x90c fs/jfs/namei.c:137
 lookup_open fs/namei.c:3490 [inline]
 open_last_lookups fs/namei.c:3558 [inline]
 path_openat+0xda8/0x27a0 fs/namei.c:3788
 do_filp_open+0x198/0x38c fs/namei.c:3818
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: f0043ca3 91108063 52817b82 979d5745 (d4210000) 
---[ end trace 0000000000000000 ]---