From: syzbot <syzbot+885a4f3281b8d99c48d8@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tristmd@gmail.com
Subject: Re: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit
Date: Mon, 04 May 2026 16:23:02 -0700 [thread overview]
Message-ID: <69f92a56.050a0220.892e9.00dd.GAE@google.com> (raw)
In-Reply-To: <177793457212.208789.6662052297059821760@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lbmIODone
==================================================================
==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1418/0x17a0 fs/jfs/jfs_logmgr.c:2308
Read of size 4 at addr ffff88803d442608 by task ksoftirqd/0/15
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lbmIODone+0x1418/0x17a0 fs/jfs/jfs_logmgr.c:2308
blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
blk_complete_reqs block/blk-mq.c:1253 [inline]
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
run_ksoftirqd+0x52/0x180 kernel/softirq.c:1076
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6769:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
kmalloc_noprof include/linux/slab.h:950 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1820 [inline]
lmLogInit+0x3ee/0x18b0 fs/jfs/jfs_logmgr.c:1267
open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6192:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6250 [inline]
kfree+0x1c5/0x6c0 mm/slub.c:6565
lbmLogShutdown+0x283/0x350 fs/jfs/jfs_logmgr.c:1865
lmLogShutdown+0x415/0x780 fs/jfs/jfs_logmgr.c:1681
lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88803d442600
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
freed 256-byte region [ffff88803d442600, ffff88803d442700)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d442
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88801a00bb40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88801a00bb40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4960, tgid 4960 (udevd), ts 172905709445, free_ts 172859766288
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x33c/0x3d0 mm/slub.c:7255
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
smack_d_instantiate+0x89c/0x990 security/smack/smack_lsm.c:3688
security_d_instantiate+0x106/0x1d0 security/security.c:3704
d_splice_alias_ops+0x71/0x3e0 fs/dcache.c:3141
__lookup_slow+0x2d2/0x440 fs/namei.c:1915
lookup_slow+0x53/0x70 fs/namei.c:1932
walk_component fs/namei.c:2278 [inline]
link_path_walk+0xd1e/0x18d0 fs/namei.c:2652
path_openat+0x2d5/0x38a0 fs/namei.c:4854
do_file_open+0x23e/0x4a0 fs/namei.c:4887
page last free pid 6638 tgid 6638 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1402 [inline]
__free_frozen_pages+0xfa6/0x10f0 mm/page_alloc.c:2943
__slab_free+0x252/0x2a0 mm/slub.c:5612
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x33b/0x680 mm/slub.c:4905
vm_area_dup+0x2b/0x670 mm/vma_init.c:123
__split_vma+0x1e4/0xa30 mm/vma.c:516
split_vma mm/vma.c:599 [inline]
vma_modify+0x9f9/0x1f20 mm/vma.c:1699
vma_modify_flags+0x24b/0x330 mm/vma.c:1719
mprotect_fixup+0x62a/0xb60 mm/mprotect.c:789
do_mprotect_pkey+0x8d5/0xd20 mm/mprotect.c:967
__do_sys_mprotect mm/mprotect.c:988 [inline]
__se_sys_mprotect mm/mprotect.c:985 [inline]
__x64_sys_mprotect+0x80/0x90 mm/mprotect.c:985
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88803d442500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88803d442580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88803d442600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803d442680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803d442700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: c7e4e4d5 Merge tag 'for-linus-7.1-2' of https://github..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=115a7b48580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2e8ebfec4636d32
dashboard link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=13f76696580000
next parent reply other threads:[~2026-05-04 23:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <177793457212.208789.6662052297059821760@gmail.com>
2026-05-04 23:23 ` syzbot [this message]
[not found] <177806821520.70463.9413046159939389370@gmail.com>
2026-05-06 13:59 ` [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit syzbot
[not found] <69f9e3be.050a0220.c7d39.a142@mx.google.com>
2026-05-05 13:26 ` syzbot
[not found] <177759080895.1633114.18321249853733805964@gmail.com>
2026-05-04 21:58 ` syzbot
2024-10-13 3:29 [syzbot] " Qianqiang Liu
2024-10-13 4:49 ` [syzbot] [jfs?] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69f92a56.050a0220.892e9.00dd.GAE@google.com \
--to=syzbot+885a4f3281b8d99c48d8@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tristmd@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.