From: sanan.hasanou@gmail.com
To: shaggy@kernel.org, brauner@kernel.org, mjguzik@gmail.com,
ssrane_b23@ee.vjti.ac.in, jfs-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: KASAN: slab-use-after-free Read in jfs_lazycommit
Date: Fri, 26 Jun 2026 14:27:00 -0700 (PDT) [thread overview]
Message-ID: <6a3eeea4.3bd3798c.41f1c.06f6@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1sVxTU3tztwbXVxVud4pFzl2EIDdR3aOC>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
==================================================================
BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x74b/0xa90 fs/jfs/jfs_txnmgr.c:2737
Read of size 4 at addr ffff88806b71e894 by task jfsCommit/112
CPU: 1 UID: 0 PID: 112 Comm: jfsCommit Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
jfs_lazycommit+0x74b/0xa90 fs/jfs/jfs_txnmgr.c:2737
kthread+0x389/0x480 kernel/kthread.c:467
ret_from_fork+0x507/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 32010:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x325/0x680 mm/slub.c:5339
kmalloc_noprof include/linux/slab.h:962 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
jfs_fill_super+0xc2/0xd80 fs/jfs/super.c:452
get_tree_bdev_flags+0x402/0x4c0 fs/super.c:1694
vfs_get_tree+0x8c/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3760 [inline]
do_new_mount+0x31a/0xce0 fs/namespace.c:3836
do_mount fs/namespace.c:4159 [inline]
__do_sys_mount fs/namespace.c:4348 [inline]
__se_sys_mount+0x313/0x400 fs/namespace.c:4325
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 23283:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2687 [inline]
slab_free mm/slub.c:6124 [inline]
kfree+0x1c5/0x640 mm/slub.c:6442
generic_shutdown_super+0x137/0x2c0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xb6/0x120 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1ce/0x250 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x33b/0xfc0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x4b/0x53
The buggy address belongs to the object at ffff88806b71e800
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 148 bytes inside of
freed 256-byte region [ffff88806b71e800, ffff88806b71e900)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806b71fc00 pfn:0x6b71e
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000240 ffff888018841b40 ffffea00011ed010 ffffea00016dd610
raw: ffff88806b71fc00 000000000010000a 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff888018841b40 ffffea00011ed010 ffffea00016dd610
head: ffff88806b71fc00 000000000010000a 00000000f5000000 0000000000000000
head: 04fff00000000001 ffffea0001adc781 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 30812, tgid 30807 (syz.5.3073), ts 208748051074, free_ts 208732083627
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x238/0x290 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24e0/0x2570 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3255 [inline]
allocate_slab+0x77/0x670 mm/slub.c:3444
new_slab mm/slub.c:3502 [inline]
refill_objects+0x33a/0x3d0 mm/slub.c:7134
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x2b6/0x620 mm/slub.c:4578
alloc_from_pcs mm/slub.c:4681 [inline]
slab_alloc_node mm/slub.c:4815 [inline]
__do_kmalloc_node mm/slub.c:5218 [inline]
__kmalloc_noprof+0x478/0x770 mm/slub.c:5231
kmalloc_noprof include/linux/slab.h:966 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
new_dir fs/proc/proc_sysctl.c:966 [inline]
get_subdir fs/proc/proc_sysctl.c:1010 [inline]
sysctl_mkdir_p fs/proc/proc_sysctl.c:1320 [inline]
__register_sysctl_table+0xba1/0x1340 fs/proc/proc_sysctl.c:1395
neigh_sysctl_register+0x9a2/0xa80 net/core/neighbour.c:3922
addrconf_sysctl_register+0xb3/0x1c0 net/ipv6/addrconf.c:7371
ipv6_add_dev+0xd21/0x13a0 net/ipv6/addrconf.c:459
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3654
notifier_call_chain+0x1b8/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
register_netdevice+0x16f3/0x1ca0 net/core/dev.c:11449
tun_set_iff+0x83f/0xf00 drivers/net/tun.c:2807
__tun_chr_ioctl+0x783/0x1df0 drivers/net/tun.c:3088
page last free pid 30812 tgid 30807 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc3e/0xdd0 mm/page_alloc.c:2978
__slab_free+0x25e/0x2b0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
__do_kmalloc_node mm/slub.c:5218 [inline]
__kmalloc_noprof+0x31b/0x770 mm/slub.c:5231
kmalloc_noprof include/linux/slab.h:966 [inline]
sk_prot_alloc+0xe7/0x210 net/core/sock.c:2245
sk_alloc+0x3a/0x380 net/core/sock.c:2301
tun_chr_open+0x7a/0x510 drivers/net/tun.c:3398
misc_open+0x2d8/0x340 drivers/char/misc.c:163
chrdev_open+0x4c8/0x5d0 fs/char_dev.c:411
do_dentry_open+0x77a/0x14d0 fs/open.c:949
vfs_open+0x3b/0x340 fs/open.c:1081
do_open fs/namei.c:4671 [inline]
path_openat+0x2d02/0x3740 fs/namei.c:4830
do_file_open+0x203/0x440 fs/namei.c:4859
do_sys_openat2+0x105/0x1e0 fs/open.c:1366
Memory state around the buggy address:
ffff88806b71e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806b71e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806b71e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806b71e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806b71e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
raw: 04fff00000000240 ffff888018841b40 ffffea00011ed010 ffffea00016dd610
raw: ffff88806b71fc00 000000000010000a 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff888018841b40 ffffea00011ed010 ffffea00016dd610
head: ffff88806b71fc00 000000000010000a 00000000f5000000 0000000000000000
head: 04fff00000000001 ffffea0001adc781 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 30812, tgid 30807 (syz.5.3073), ts 208748051074, free_ts 208732083627
post_alloc_hook+0x238/0x290
get_page_from_freelist+0x24e0/0x2570
__alloc_frozen_pages_noprof+0x181/0x370
allocate_slab+0x77/0x670
refill_objects+0x33a/0x3d0
__pcs_replace_empty_main+0x2b6/0x620
__kmalloc_noprof+0x478/0x770
__register_sysctl_table+0xba1/0x1340
neigh_sysctl_register+0x9a2/0xa80
addrconf_sysctl_register+0xb3/0x1c0
ipv6_add_dev+0xd21/0x13a0
addrconf_notify+0x771/0x1050
notifier_call_chain+0x1b8/0x3f0
register_netdevice+0x16f3/0x1ca0
tun_set_iff+0x83f/0xf00
__tun_chr_ioctl+0x783/0x1df0
page last free pid 30812 tgid 30807 stack trace:
__free_frozen_pages+0xc3e/0xdd0
__slab_free+0x25e/0x2b0
qlist_free_all+0x97/0x100
kasan_quarantine_reduce+0x143/0x160
__kasan_slab_alloc+0x22/0x80
__kmalloc_noprof+0x31b/0x770
sk_prot_alloc+0xe7/0x210
sk_alloc+0x3a/0x380
tun_chr_open+0x7a/0x510
misc_open+0x2d8/0x340
chrdev_open+0x4c8/0x5d0
do_dentry_open+0x77a/0x14d0
vfs_open+0x3b/0x340
path_openat+0x2d02/0x3740
do_file_open+0x203/0x440
do_sys_openat2+0x105/0x1e0
Memory state around the buggy address:
ffff88806b71e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806b71e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806b71e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806b71e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806b71e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 1 UID: 0 PID: 112 Comm: jfsCommit Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
vpanic+0x41f/0xa20
panic+0xb9/0xc0
check_panic_on_warn+0x84/0xa0
end_report+0x73/0x180
kasan_report+0x129/0x150
jfs_lazycommit+0x74b/0xa90
kthread+0x389/0x480
ret_from_fork+0x507/0xb90
ret_from_fork_asm+0x11/0x20
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
reply other threads:[~2026-06-26 21:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3eeea4.3bd3798c.41f1c.06f6@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=brauner@kernel.org \
--cc=contact@pgazz.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mjguzik@gmail.com \
--cc=shaggy@kernel.org \
--cc=ssrane_b23@ee.vjti.ac.in \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.