From: Shuangpeng <shuangpeng.kernel@gmail.com>
To: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: jack@suse.com, tytso@mit.edu
Subject: KASAN: slab-use-after-free Write in jbd2_journal_commit_transaction
Date: Thu, 26 Mar 2026 14:57:53 -0400 [thread overview]
Message-ID: <DEF763BA-150C-4512-997F-CF079BDA9259@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following KASAN report while testing current upstream kernel:
KASAN: slab-use-after-free in jbd2_journal_commit_transaction
on commit: bbeb83d3182abe0d245318e274e8531e5dd7a948 (Mar 24 2026)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/032c84edf2505f7f74fb5757e1e6cd1d
The same reproducer sometimes also triggers a KASAN slab-out-of-bounds
report at the same site, which may indicate the same underlying bug.
I’m happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 80.268862][ T8554] ==================================================================
[ 80.269678][ T8554] BUG: KASAN: slab-use-after-free in jbd2_journal_commit_transaction (./include/linux/instrumented.h:97 ./include/asm-generic/bitops/instrumented-atomic.h:42 ./include/linux/jbd2.h:320 fs/jbd2/commit.c:828)
[ 80.270623][ T8554] Write of size 8 at addr ffff8881687ee5e8 by task jbd2/loop0-4107/8554
[ 80.271460][ T8554]
[ 80.271710][ T8554] CPU: 1 UID: 0 PID: 8554 Comm: jbd2/loop0-4107 Not tainted 7.0.0-rc5-00051-gbbeb83d3182a #35 PR
[ 80.271719][ T8554] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 80.271726][ T8554] Call Trace:
[ 80.271729][ T8554] <TASK>
[ 80.271732][ T8554] dump_stack_lvl (lib/dump_stack.c:122)
[ 80.271743][ T8554] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 80.271795][ T8554] kasan_report (mm/kasan/report.c:597)
[ 80.271813][ T8554] kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200)
[ 80.271821][ T8554] jbd2_journal_commit_transaction (./include/linux/instrumented.h:97 ./include/asm-generic/bitops/instrumented-atomic.h:42 ./include/linux/jbd2.h:320 fs/jbd2/commit.c:828)
[ 80.271912][ T8554] kjournald2 (fs/jbd2/journal.c:202)
[ 80.271974][ T8554] kthread (kernel/kthread.c:437)
[ 80.271986][ T8554] ret_from_fork (arch/x86/kernel/process.c:164)
[ 80.272022][ T8554] ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
[ 80.272034][ T8554] </TASK>
[ 80.272036][ T8554]
[ 80.292650][ T8554] Freed by task 8373 on cpu 1 at 42.645081s:
[ 80.293268][ T8554] kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)
[ 80.293766][ T8554] kasan_save_free_info (mm/kasan/generic.c:587)
[ 80.294292][ T8554] __kasan_slab_free (mm/kasan/common.c:287)
[ 80.294796][ T8554] kfree (mm/slub.c:6165 mm/slub.c:6483)
[ 80.295206][ T8554] tomoyo_realpath_from_path (security/tomoyo/realpath.c:287)
[ 80.295789][ T8554] tomoyo_realpath_nofollow (security/tomoyo/realpath.c:304)
[ 80.296344][ T8554] tomoyo_find_next_domain (security/tomoyo/domain.c:731)
[ 80.296910][ T8554] tomoyo_bprm_check_security (security/tomoyo/tomoyo.c:102)
[ 80.297486][ T8554] security_bprm_check (security/security.c:795)
[ 80.298020][ T8554] bprm_execve (fs/exec.c:1655 fs/exec.c:1696 fs/exec.c:1748)
[ 80.298486][ T8554] do_execveat_common (fs/exec.c:1846)
[ 80.299019][ T8554] __x64_sys_execve (fs/exec.c:1930 fs/exec.c:1924 fs/exec.c:1924)
[ 80.299510][ T8554] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 80.299984][ T8554] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 80.300597][ T8554]
[ 80.300847][ T8554] The buggy address belongs to the object at ffff8881687ee000
[ 80.300847][ T8554] which belongs to the cache kmalloc-4k of size 4096
[ 80.302261][ T8554] The buggy address is located 1512 bytes inside of
[ 80.302261][ T8554] freed 4096-byte region [ffff8881687ee000, ffff8881687ef000)
[ 80.303678][ T8554]
[ 80.303930][ T8554] The buggy address belongs to the physical page:
[ 80.304590][ T8554] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1687e8
[ 80.305499][ T8554] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 80.306363][ T8554] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
[ 80.307153][ T8554] page_type: f5(slab)
[ 80.307663][ T8554] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122
[ 80.308538][ T8554] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 80.309414][ T8554] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122
[ 80.310296][ T8554] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 80.311186][ T8554] head: 017ff00000000003 ffffea0005a1fa01 00000000ffffffff 00000000ffffffff
[ 80.312076][ T8554] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 80.312957][ T8554] page dumped because: kasan: bad access detected
[ 80.313612][ T8554] page_owner tracks the page as allocated
[ 80.314196][ T8554] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN6
[ 80.316275][ T8554] post_alloc_hook (./include/linux/page_owner.h:? mm/page_alloc.c:1889)
[ 80.316774][ T8554] get_page_from_freelist (mm/page_alloc.c:? mm/page_alloc.c:3962)
[ 80.317348][ T8554] __alloc_frozen_pages_noprof (mm/page_alloc.c:5250)
[ 80.317952][ T8554] allocate_slab (mm/slub.c:3294 mm/slub.c:3481)
[ 80.318430][ T8554] refill_objects (mm/slub.c:7176)
[ 80.318935][ T8554] __pcs_replace_empty_main (mm/slub.c:? mm/slub.c:4615)
[ 80.319510][ T8554] __kmalloc_noprof (mm/slub.c:4718 mm/slub.c:4851 mm/slub.c:5259 mm/slub.c:5272)
[ 80.320017][ T8554] tomoyo_realpath_from_path (security/tomoyo/realpath.c:252)
[ 80.320591][ T8554] tomoyo_path_perm (security/tomoyo/file.c:151 security/tomoyo/file.c:827)
[ 80.321100][ T8554] security_inode_getattr (security/security.c:1870)
[ 80.321648][ T8554] __se_sys_newfstat (fs/stat.c:260 fs/stat.c:281 fs/stat.c:551 fs/stat.c:546)
[ 80.322157][ T8554] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 80.322632][ T8554] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 80.323246][ T8554] page last free pid 1 tgid 1 stack trace:
[ 80.323852][ T8554] __free_frozen_pages (./include/linux/page_owner.h:? mm/page_alloc.c:1433 mm/page_alloc.c:2978)
[ 80.324384][ T8554] free_contig_range (mm/page_alloc.c:7373)
[ 80.324886][ T8554] destroy_args (mm/debug_vm_pgtable.c:995)
[ 80.325363][ T8554] debug_vm_pgtable (mm/debug_vm_pgtable.c:?)
[ 80.325870][ T8554] do_one_initcall (init/main.c:?)
[ 80.326370][ T8554] do_initcall_level (init/main.c:1443)
[ 80.326890][ T8554] do_initcalls (init/main.c:1457)
[ 80.327346][ T8554] kernel_init_freeable (init/main.c:1696)
[ 80.327888][ T8554] kernel_init (init/main.c:1584)
[ 80.328342][ T8554] ret_from_fork (arch/x86/kernel/process.c:164)
[ 80.328827][ T8554] ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
[ 80.329327][ T8554]
[ 80.329577][ T8554] Memory state around the buggy address:
[ 80.330154][ T8554] ffff8881687ee480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.330981][ T8554] ffff8881687ee500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.331803][ T8554] >ffff8881687ee580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.332625][ T8554] ^
[ 80.333389][ T8554] ffff8881687ee600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.334209][ T8554] ffff8881687ee680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.335033][ T8554] ==================================================================
Best,
Shuangpeng
reply other threads:[~2026-03-26 18:58 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DEF763BA-150C-4512-997F-CF079BDA9259@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=jack@suse.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox