* Forwarded: [PATCH] jfs: fix KMSAN warning in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
@ 2026-01-23 5:12 ` syzbot
2026-01-23 5:31 ` syzbot
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-01-23 5:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: fix KMSAN warning in txLock
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Syzbot reported a KMSAN uninit-value warning in txLock when accessing
jfs_ip->atlhead:
BUG: KMSAN: uninit-value in txLock+0x13a2/0x2900 fs/jfs/jfs_txnmgr.c:659
This occurs because the jfs_inode_info structure is allocated from a
slab cache but not fully initialized, leaving fields like atlhead,
atltail, and anon_inode_list with garbage values from previously freed
inodes.
When txLock() attempts to traverse the anonymous transaction lock list
by reading jfs_ip->atlhead, it accesses uninitialized memory, triggering
the KMSAN warning.
Fix this by zeroing the entire jfs_inode_info structure in
jfs_alloc_inode(). This is consistent with how other filesystems handle
inode allocation and ensures all fields start with known values,
preventing this and potential similar bugs.
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/jfs/super.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 3cfb86c5a36e..236fe8d42542 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -105,9 +105,7 @@ static struct inode *jfs_alloc_inode(struct super_block *sb)
jfs_inode = alloc_inode_sb(sb, jfs_inode_cachep, GFP_NOFS);
if (!jfs_inode)
return NULL;
-#ifdef CONFIG_QUOTA
- memset(&jfs_inode->i_dquot, 0, sizeof(jfs_inode->i_dquot));
-#endif
+ memset(jfs_inode, 0, sizeof(struct jfs_inode_info));
return &jfs_inode->vfs_inode;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: [PATCH] jfs: fix KMSAN warning in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
2026-01-23 5:12 ` Forwarded: [PATCH] jfs: fix KMSAN warning " syzbot
@ 2026-01-23 5:31 ` syzbot
2026-01-23 5:33 ` syzbot
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-01-23 5:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: fix KMSAN warning in txLock
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git maste
Syzbot reported a KMSAN uninit-value warning in txLock when accessing
the global TxLock array:
BUG: KMSAN: uninit-value in txLock+0x13a2/0x2900 fs/jfs/jfs_txnmgr.c:659
The issue occurs because txInit() allocates the TxLock array using
vmalloc(), which does not zero the allocated memory. When txLock()
traverses the transaction lock list by accessing elements in this array
(via lid_to_tlock()), it reads uninitialized 'next' pointers, triggering
the KMSAN warning.
The uninitialized memory originates from:
vmalloc_noprof+0xce/0x140 mm/vmalloc.c:4146
txInit+0xb5c/0xfa0 fs/jfs/jfs_txnmgr.c:297
Fix this by using vzalloc() instead of vmalloc() to ensure the TxLock
array is zero-initialized. This guarantees that all tlock structures
start with valid initial values, particularly the 'next' field which is
used for list traversal.
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/jfs/jfs_txnmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c16578af3a77..4c72103a0b46 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -294,7 +294,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: [PATCH] jfs: fix KMSAN warning in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
2026-01-23 5:12 ` Forwarded: [PATCH] jfs: fix KMSAN warning " syzbot
2026-01-23 5:31 ` syzbot
@ 2026-01-23 5:33 ` syzbot
2026-04-17 10:11 ` Forwarded: [PATCH] jfs: fix uninit-value " syzbot
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-01-23 5:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: fix KMSAN warning in txLock
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Syzbot reported a KMSAN uninit-value warning in txLock when accessing
the global TxLock array:
BUG: KMSAN: uninit-value in txLock+0x13a2/0x2900 fs/jfs/jfs_txnmgr.c:659
The issue occurs because txInit() allocates the TxLock array using
vmalloc(), which does not zero the allocated memory. When txLock()
traverses the transaction lock list by accessing elements in this array
(via lid_to_tlock()), it reads uninitialized 'next' pointers, triggering
the KMSAN warning.
The uninitialized memory originates from:
vmalloc_noprof+0xce/0x140 mm/vmalloc.c:4146
txInit+0xb5c/0xfa0 fs/jfs/jfs_txnmgr.c:297
Fix this by using vzalloc() instead of vmalloc() to ensure the TxLock
array is zero-initialized. This guarantees that all tlock structures
start with valid initial values, particularly the 'next' field which is
used for list traversal.
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/jfs/jfs_txnmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c16578af3a77..4c72103a0b46 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -294,7 +294,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: [PATCH] jfs: fix uninit-value in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
` (2 preceding siblings ...)
2026-01-23 5:33 ` syzbot
@ 2026-04-17 10:11 ` syzbot
2026-04-17 13:30 ` Forwarded: [PATCH v2] jfs: fix uninit-value and assert crash " syzbot
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-04-17 10:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: fix uninit-value in txLock
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
txInit() allocates the TxLock array with vmalloc(), which does not zero
memory. The initialization loop only sets the .next field of each tlock
entry to chain them on the freelist. All other fields, including .tid,
.flag, .type, .mp, .ip, and the .lock[] overlay area, remain
uninitialized.
When txLock() looks up a tlock via lid_to_tlock(lid), it reads
tlck->tid to determine whether the page is already locked by the
requesting transaction. If this tlock entry was never previously
allocated and freed (txLockFree only sets .tid and .next), the .tid
field contains uninitialized vmalloc data, which KMSAN flags as a
use of uninitialized memory.
Fix this by replacing vmalloc() with vzalloc() so that all tlock fields
are zero-initialized at allocation time. This ensures .tid == 0 (the
anonymous/free state) for every tlock entry from the start, consistent
with what txLockFree() sets on deallocation.
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_txnmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c16578af3a77..4c72103a0b46 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -295,7 +295,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: [PATCH v2] jfs: fix uninit-value and assert crash in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
` (3 preceding siblings ...)
2026-04-17 10:11 ` Forwarded: [PATCH] jfs: fix uninit-value " syzbot
@ 2026-04-17 13:30 ` syzbot
2026-04-17 16:19 ` Forwarded: Re: [syzbot] KMSAN: uninit-value " syzbot
2026-04-17 19:11 ` Forwarded: Re: [syzbot] [jfs?] " syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-04-17 13:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v2] jfs: fix uninit-value and assert crash in txLock
Author: tristmd@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
From: Tristan Madani <tristan@talencesecurity.com>
Date: Thu, 17 Apr 2026
Subject: [PATCH v2] jfs: fix uninit-value and assert crash in txLock
Two bugs in txLock():
1) txInit() allocates the TxLock array with vmalloc(), which does not
zero memory. The initialization loop only sets .next, leaving .tid
uninitialized. When txLock() reads tlck->tid it hits uninitialized
vmalloc data. Fix: vmalloc -> vzalloc.
2) The anonymous tlock list walk uses assert(last) inside a for-loop.
On a corrupted filesystem image the list can be inconsistent, causing
last == 0 before finding the target lid. This triggers BUG() via
the assert macro. Fix: replace assert with graceful error + goto
grantLock.
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_txnmgr.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 083dbbb0c..ec6217a2c 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -295,7 +295,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
@@ -660,7 +660,10 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
for (last = jfs_ip->atlhead;
lid_to_tlock(last)->next != lid;
last = lid_to_tlock(last)->next) {
- assert(last);
+ if (!last) {
+ jfs_err("txLock: lid %d not found in atl list", lid);
+ goto grantLock;
+ }
}
lid_to_tlock(last)->next = tlck->next;
if (jfs_ip->atltail == lid)
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: Re: [syzbot] KMSAN: uninit-value in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
` (4 preceding siblings ...)
2026-04-17 13:30 ` Forwarded: [PATCH v2] jfs: fix uninit-value and assert crash " syzbot
@ 2026-04-17 16:19 ` syzbot
2026-04-17 19:11 ` Forwarded: Re: [syzbot] [jfs?] " syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-04-17 16:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] KMSAN: uninit-value in txLock
Author: tristmd@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 8cb6363dbe6d297ef3b9051425b83f630d9b93e9 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:13 +0000
Subject: [PATCH] jfs: fix uninit-value in txLock by zero-initializing TxLock
array
txInit() allocates the TxLock array via vmalloc(), which does not
zero memory. The init loop only sets .next for freelist chaining,
leaving all other fields (including .tid) uninitialized. When
txLock() reads tlck->tid for a tlock that was never previously
allocated and freed, KMSAN reports uninit-value.
Additionally, the assert(last) in the anonymous tlock list walk
can trigger a BUG_ON when a corrupted filesystem image produces
an inconsistent tlock list. Replace with a graceful error path.
Fix both issues:
1. Replace vmalloc() with vzalloc() so all tlock fields start zeroed
2. Replace assert(last) with a graceful error recovery
Reported-by: syzbot+d3a57c32b9112d7b01ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_txnmgr.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 083dbbb..ec6217a 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -295,7 +295,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
@@ -660,7 +660,10 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
for (last = jfs_ip->atlhead;
lid_to_tlock(last)->next != lid;
last = lid_to_tlock(last)->next) {
- assert(last);
+ if (!last) {
+ jfs_err("txLock: lid %d not found in atl list", lid);
+ goto grantLock;
+ }
}
lid_to_tlock(last)->next = tlck->next;
if (jfs_ip->atltail == lid)
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* Forwarded: Re: [syzbot] [jfs?] KMSAN: uninit-value in txLock
2026-01-22 18:49 [syzbot] [jfs?] KMSAN: uninit-value in txLock syzbot
` (5 preceding siblings ...)
2026-04-17 16:19 ` Forwarded: Re: [syzbot] KMSAN: uninit-value " syzbot
@ 2026-04-17 19:11 ` syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2026-04-17 19:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [jfs?] KMSAN: uninit-value in txLock
Author: tristmd@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -174,14 +174,10 @@ static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
{
struct metapage *mp = mempool_alloc(metapage_mempool, gfp_mask);
- if (mp) {
- mp->lid = 0;
- mp->lsn = 0;
- mp->data = NULL;
- mp->clsn = 0;
- mp->log = NULL;
+ if (mp) {
+ memset(mp, 0, sizeof(*mp));
init_waitqueue_head(&mp->wait);
- }
+ }
return mp;
}
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -295,7 +295,7 @@ int txInit(void)
* tlock id = 0 is reserved.
*/
size = sizeof(struct tlock) * nTxLock;
- TxLock = vmalloc(size);
+ TxLock = vzalloc(size);
if (TxLock == NULL) {
vfree(TxBlock);
return -ENOMEM;
@@ -660,7 +660,10 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
for (last = jfs_ip->atlhead;
lid_to_tlock(last)->next != lid;
last = lid_to_tlock(last)->next) {
- assert(last);
+ if (!last) {
+ jfs_err("txLock: lid %d not found in atl list", lid);
+ goto grantLock;
+ }
}
lid_to_tlock(last)->next = tlck->next;
if (jfs_ip->atltail == lid)
^ permalink raw reply [flat|nested] 8+ messages in thread