From: sanan.hasanou@gmail.com
To: shaggy@kernel.org, mjguzik@gmail.com, brauner@kernel.org,
ssrane_b23@ee.vjti.ac.in, jfs-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: KASAN: slab-use-after-free Write in txEnd
Date: Fri, 26 Jun 2026 14:24:10 -0700 (PDT) [thread overview]
Message-ID: <6a3eedfa.fd822575.2d6b21.e180@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1XWXrj7ZUAS3GWmqvnny_U_mcxR6_AZCL>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
... Log Wrap ... Log Wrap ... Log Wrap ...
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_write include/linux/instrumented.h:97 [inline]
BUG: KASAN: slab-use-after-free in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: slab-use-after-free in txEnd+0x32d/0x530 fs/jfs/jfs_txnmgr.c:555
Write of size 8 at addr ffff8880270b2040 by task jfsCommit/111
CPU: 0 UID: 0 PID: 111 Comm: jfsCommit Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2ab/0x2c0 mm/kasan/generic.c:200
instrument_atomic_write include/linux/instrumented.h:97 [inline]
clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
txEnd+0x32d/0x530 fs/jfs/jfs_txnmgr.c:555
txLazyCommit fs/jfs/jfs_txnmgr.c:2685 [inline]
jfs_lazycommit+0x5ba/0xa90 fs/jfs/jfs_txnmgr.c:2734
kthread+0x389/0x480 kernel/kthread.c:467
ret_from_fork+0x4eb/0xb60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 57428:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x325/0x680 mm/slub.c:5339
kmalloc_noprof include/linux/slab.h:962 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
open_inline_log fs/jfs/jfs_logmgr.c:1159 [inline]
lmLogOpen+0x2d1/0xf90 fs/jfs/jfs_logmgr.c:1069
jfs_mount_rw+0xe9/0x660 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x6b7/0xce0 fs/jfs/super.c:532
get_tree_bdev_flags+0x402/0x4c0 fs/super.c:1694
vfs_get_tree+0x8c/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3760 [inline]
do_new_mount+0x31a/0xce0 fs/namespace.c:3836
do_mount fs/namespace.c:4159 [inline]
__do_sys_mount fs/namespace.c:4348 [inline]
__se_sys_mount fs/namespace.c:4325 [inline]
__x64_sys_mount+0x35d/0x450 fs/namespace.c:4325
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 49422:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2687 [inline]
slab_free mm/slub.c:6124 [inline]
kfree+0x1c5/0x640 mm/slub.c:6442
lmLogClose+0x297/0x520 fs/jfs/jfs_logmgr.c:-1
jfs_umount+0x2ef/0x3c0 fs/jfs/jfs_umount.c:114
jfs_put_super+0x68/0x170 fs/jfs/super.c:194
generic_shutdown_super+0x137/0x2c0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xb6/0x120 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1ce/0x250 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x33b/0xfc0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x4b/0x53
The buggy address belongs to the object at ffff8880270b2000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 64 bytes inside of
freed 1024-byte region [ffff8880270b2000, ffff8880270b2400)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x270b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x1ffe00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 01ffe00000000040 ffff888018441dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 01ffe00000000040 ffff888018441dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 01ffe00000000003 ffffea00009c2c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9376, tgid 9376 (syz-executor), ts 55306766293, free_ts 55268579335
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x238/0x290 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2570 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3255 [inline]
allocate_slab+0x77/0x670 mm/slub.c:3444
new_slab mm/slub.c:3502 [inline]
refill_objects+0x33a/0x3d0 mm/slub.c:7134
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x2b6/0x620 mm/slub.c:4578
alloc_from_pcs mm/slub.c:4681 [inline]
slab_alloc_node mm/slub.c:4815 [inline]
__do_kmalloc_node mm/slub.c:5218 [inline]
__kmalloc_noprof+0x478/0x770 mm/slub.c:5231
kmalloc_noprof include/linux/slab.h:966 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
__alloc_workqueue+0xff/0x1e90 kernel/workqueue.c:5780
alloc_workqueue_noprof+0xd4/0x200 kernel/workqueue.c:5883
tipc_topsrv_work_start net/tipc/topsrv.c:641 [inline]
tipc_topsrv_start net/tipc/topsrv.c:679 [inline]
tipc_topsrv_init_net+0x3c6/0x830 net/tipc/topsrv.c:727
ops_init+0x358/0x5c0 net/core/net_namespace.c:137
setup_net+0x110/0x330 net/core/net_namespace.c:446
copy_net_ns+0x50a/0x730 net/core/net_namespace.c:581
create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0x11c/0x160 kernel/nsproxy.c:226
ksys_unshare+0x4c8/0x8b0 kernel/fork.c:3174
page last free pid 9384 tgid 9384 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc3d/0xdd0 mm/page_alloc.c:2978
__slab_free+0x25e/0x2b0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_node_noprof+0x391/0x6a0 mm/slub.c:4882
__alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
netlink_sendmsg+0x5c6/0xb30 net/netlink/af_netlink.c:1869
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x447/0x620 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Memory state around the buggy address:
ffff8880270b1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880270b1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880270b2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880270b2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880270b2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x270b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x1ffe00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 01ffe00000000040 ffff888018441dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 01ffe00000000040 ffff888018441dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 01ffe00000000003 ffffea00009c2c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9376, tgid 9376 (syz-executor), ts 55306766293, free_ts 55268579335
post_alloc_hook+0x238/0x290
get_page_from_freelist+0x24dc/0x2570
__alloc_frozen_pages_noprof+0x181/0x370
allocate_slab+0x77/0x670
refill_objects+0x33a/0x3d0
__pcs_replace_empty_main+0x2b6/0x620
__kmalloc_noprof+0x478/0x770
__alloc_workqueue+0xff/0x1e90
alloc_workqueue_noprof+0xd4/0x200
tipc_topsrv_init_net+0x3c6/0x830
ops_init+0x358/0x5c0
setup_net+0x110/0x330
copy_net_ns+0x50a/0x730
create_new_namespaces+0x3e7/0x6a0
unshare_nsproxy_namespaces+0x11c/0x160
ksys_unshare+0x4c8/0x8b0
page last free pid 9384 tgid 9384 stack trace:
__free_frozen_pages+0xc3d/0xdd0
__slab_free+0x25e/0x2b0
qlist_free_all+0x97/0x100
kasan_quarantine_reduce+0x143/0x160
__kasan_slab_alloc+0x22/0x80
kmem_cache_alloc_node_noprof+0x391/0x6a0
__alloc_skb+0x1d0/0x7d0
netlink_sendmsg+0x5c6/0xb30
__sys_sendto+0x447/0x620
__x64_sys_sendto+0xde/0xf0
do_syscall_64+0x160/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Memory state around the buggy address:
ffff8880270b1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880270b1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880270b2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880270b2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880270b2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 111 Comm: jfsCommit Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
vpanic+0x41f/0xa30
panic+0xb9/0xc0
check_panic_on_warn+0x84/0xa0
end_report+0x73/0x180
kasan_report+0x129/0x150
kasan_check_range+0x2ab/0x2c0
txEnd+0x32d/0x530
jfs_lazycommit+0x5ba/0xa90
kthread+0x389/0x480
ret_from_fork+0x4eb/0xb60
ret_from_fork_asm+0x11/0x20
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
reply other threads:[~2026-06-26 21:24 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3eedfa.fd822575.2d6b21.e180@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=brauner@kernel.org \
--cc=contact@pgazz.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mjguzik@gmail.com \
--cc=shaggy@kernel.org \
--cc=ssrane_b23@ee.vjti.ac.in \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.