From: syzbot <syzbot+ea7ed3bb2f444cb4dfeb@syzkaller.appspotmail.com>
To: jfs-discussion@lists.sourceforge.net, jie.wang@intel.com,
linux-kernel@vger.kernel.org, shaggy@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] KASAN: slab-use-after-free Write in lmLogSync
Date: Thu, 25 Jun 2026 12:01:28 -0700 [thread overview]
Message-ID: <6a3d7b08.80e5668d.5d0ef.0006.GAE@google.com> (raw)
In-Reply-To: <6a1eb319.c1435f33.112120.0156.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: ab9de95c9cf9 Merge tag 'rust-7.2-2' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11e27046580000
kernel config: https://syzkaller.appspot.com/x/.config?x=86ba763b42fa66a
dashboard link: https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109b430e580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c16df342a923/disk-ab9de95c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ddf00a828178/vmlinux-ab9de95c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f468c716a7be/bzImage-ab9de95c.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/410234fc5bd7/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=13bc540a580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ea7ed3bb2f444cb4dfeb@syzkaller.appspotmail.com
... Log Wrap ... Log Wrap ... Log Wrap ...
==================================================================
BUG: KASAN: slab-use-after-free in lmLogSync+0x9a5/0xa40 fs/jfs/jfs_logmgr.c:1003
Write of size 4 at addr ffff888078b39a18 by task jfsCommit/119
CPU: 1 UID: 0 PID: 119 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lmLogSync+0x9a5/0xa40 fs/jfs/jfs_logmgr.c:1003
jfs_syncpt+0x7b/0x90 fs/jfs/jfs_logmgr.c:1039
txEnd+0x2e5/0x530 fs/jfs/jfs_txnmgr.c:551
txLazyCommit fs/jfs/jfs_txnmgr.c:2686 [inline]
jfs_lazycommit+0x5d6/0xac0 fs/jfs/jfs_txnmgr.c:2735
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6176:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5515
_kmalloc_noprof include/linux/slab.h:969 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
open_inline_log fs/jfs/jfs_logmgr.c:1157 [inline]
lmLogOpen+0x2d1/0xf90 fs/jfs/jfs_logmgr.c:1067
jfs_mount_rw+0xf3/0x670 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x769/0xda0 fs/jfs/super.c:533
get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1634
vfs_get_tree+0x92/0x2a0 fs/super.c:1694
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3765 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3841
do_mount fs/namespace.c:4174 [inline]
__do_sys_mount fs/namespace.c:4390 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4367
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5770:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kfree+0x1c5/0x640 mm/slub.c:6720
lmLogClose+0x296/0x530 fs/jfs/jfs_logmgr.c:-1
jfs_umount+0x2da/0x3b0 fs/jfs/jfs_umount.c:124
jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x13d/0x2d0 fs/super.c:647
kill_block_super+0x44/0x90 fs/super.c:1665
deactivate_locked_super+0xbc/0x130 fs/super.c:477
cleanup_mnt+0x3d3/0x460 fs/namespace.c:1317
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x1fa/0x730 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888078b39800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 536 bytes inside of
freed 1024-byte region [ffff888078b39800, ffff888078b39c00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78b38
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe25dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe25dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6055, tgid 6055 (kworker/u8:2), ts 107606662230, free_ts 107579789139
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3294 [inline]
allocate_slab+0x79/0x5e0 mm/slub.c:3408
new_slab mm/slub.c:3454 [inline]
refill_objects+0x2d5/0x350 mm/slub.c:7338
refill_sheaf mm/slub.c:2832 [inline]
__pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4703
alloc_from_pcs mm/slub.c:4801 [inline]
slab_alloc_node mm/slub.c:4933 [inline]
__do_kmalloc_node mm/slub.c:5361 [inline]
__kmalloc_noprof+0x485/0x720 mm/slub.c:5387
_kmalloc_noprof include/linux/slab.h:973 [inline]
load_elf_phdrs fs/binfmt_elf.c:540 [inline]
load_elf_binary+0x2c3/0x2950 fs/binfmt_elf.c:869
search_binary_handler fs/exec.c:1694 [inline]
exec_binprm fs/exec.c:1726 [inline]
bprm_execve+0x9c7/0x1630 fs/exec.c:1778
kernel_execve+0x8c3/0x9c0 fs/exec.c:1922
call_usermodehelper_exec_async+0x20f/0x360 kernel/umh.c:109
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 4986 tgid 4986 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
__slab_free+0x274/0x2c0 mm/slub.c:5767
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4612 [inline]
slab_alloc_node mm/slub.c:4945 [inline]
kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4959
alloc_filename fs/namei.c:147 [inline]
do_getname+0x2e/0x250 fs/namei.c:187
class_filename_flags_constructor include/linux/fs.h:2561 [inline]
do_readlinkat+0xc8/0x510 fs/stat.c:569
__do_sys_readlink fs/stat.c:605 [inline]
__se_sys_readlink fs/stat.c:602 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:602
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888078b39900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888078b39980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888078b39a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888078b39a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888078b39b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-06-25 19:01 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-02 10:40 [syzbot] [jfs?] KASAN: slab-use-after-free Write in lmLogSync syzbot
2026-06-03 17:16 ` [PATCH] jfs: fix use-after-free in lmLogSync during unmount Jie Wang
2026-06-25 19:01 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3d7b08.80e5668d.5d0ef.0006.GAE@google.com \
--to=syzbot+ea7ed3bb2f444cb4dfeb@syzkaller.appspotmail.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=jie.wang@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=shaggy@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.