Forwarded: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit

[syzbot <syzbot+885a4f3281b8d99c48d8@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit
Author: kapoorarnav43@gmail.com

#syz fix 
From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001
From: ArnavKapoor <arnav@kapoorarnav43@gmail.com>
Date: Tue, 5 May 2026 20:22:56 +0530
Subject: [PATCH] jfs: Fix use-after-free in lbmIODone during log shutdown

Fix a race condition where lbmIODone() can access freed memory from lbuf
structures that have been deallocated by lbmLogShutdown() before pending
I/O operations complete.

The issue occurs when:
1. I/O operations are submitted with lbuf as bio private data
2. During filesystem unmount, lbmLogShutdown() is called which frees all
   lbuf structures
3. But the bio completion callback lbmIODone() is still pending
4. When lbmIODone() executes, it accesses the freed lbuf causing
   use-after-free

Solution:
- Add atomic counter to track pending I/O operations
- Add wait queue to wait for pending I/O to complete
- Increment counter in lbmStartIO() before submitting bio
- Decrement counter in lbmIODone() after I/O completes
- In lbmLogShutdown(), wait for all pending I/O to complete before freeing

This prevents the use-after-free by ensuring all pending I/O operations
complete before the lbuf structures are deallocated.

Link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8
Signed-off-by: ArnavKapoor <arnav@kapoorarnav43@gmail.com>
---
 fs/jfs/jfs_logmgr.c | 15 ++++++++++++++-
 fs/jfs/jfs_logmgr.h |  2 ++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61..eaeeaaa0c 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1804,6 +1804,8 @@ static int lbmLogInit(struct jfs_log * log)
   * avoid deadlock here.
   */
  init_waitqueue_head(&log->free_wait);
+ init_waitqueue_head(&log->ios_wait);
+ atomic_set(&log->ios_pending, 0);
 
  log->lbuf_free = NULL;
 
@@ -1855,6 +1857,9 @@ static void lbmLogShutdown(struct jfs_log * log)
 
  jfs_info("lbmLogShutdown: log:0x%p", log);
 
+ /* Wait for all pending I/O operations to complete */
+ wait_event(&log->ios_wait, atomic_read(&log->ios_pending) == 0);
+
  lbuf = log->lbuf_free;
  while (lbuf) {
  struct lbuf *next = lbuf->l_freelist;
@@ -2123,6 +2128,9 @@ static void lbmStartIO(struct lbuf * bp)
  bio->bi_end_io = lbmIODone;
  bio->bi_private = bp;
 
+ /* Increment pending I/O counter before submitting */
+ atomic_inc(&log->ios_pending);
+
  /* check if journaling to disk has been disabled */
  if (log->no_integrity) {
  bio->bi_iter.bi_size = 0;
@@ -2167,8 +2175,8 @@ static int lbmIOWait(struct lbuf * bp, int flag)
 static void lbmIODone(struct bio *bio)
 {
  struct lbuf *bp = bio->bi_private;
+ struct jfs_log *log = bp->l_log;
  struct lbuf *nextbp, *tail;
- struct jfs_log *log;
  unsigned long flags;
 
  /*
@@ -2298,6 +2306,11 @@ static void lbmIODone(struct bio *bio)
 
 out:
  bp->l_flag |= lbmDONE;
+
+ /* Decrement pending I/O counter and wake up if waiting */
+ if (atomic_dec_and_test(&log->ios_pending))
+ wake_up(&log->ios_wait);
+
  LCACHE_UNLOCK(flags);
 }
 
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 09e0ef6ae..b89b198d4 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -400,6 +400,8 @@ struct jfs_log {
  uuid_t uuid; /* 16: 128-bit uuid of log device */
 
  int no_integrity; /* 3: flag to disable journaling to disk */
+ atomic_t ios_pending; /* 4: count of pending I/O operations */
+ wait_queue_head_t ios_wait; /* 4: wait queue for I/O completion */
 };
 
 /*
-- 
2.43.0


On Tuesday, 5 May 2026 at 18:56:07 UTC+5:30 syzbot wrote:

Hello, 

syzbot has tested the proposed patch but the reproducer is still triggering 
an issue: 
KASAN: slab-use-after-free Read in blk_update_request 

================================================================== 
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave 
include/linux/spinlock_api_smp.h:132 [inline] 
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 
kernel/locking/spinlock.c:166 
Read of size 1 at addr ffff88802a964100 by task kworker/u8:7/165 

CPU: 0 UID: 0 PID: 165 Comm: kworker/u8:7 Not tainted syzkaller #0 
PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
Google 04/18/2026 
Workqueue: netns cleanup_net 
Call Trace: 
<TASK> 
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 
print_address_description+0x55/0x1e0 mm/kasan/report.c:378 
print_report+0x58/0x70 mm/kasan/report.c:482 
kasan_report+0x117/0x150 mm/kasan/report.c:595 
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:574 
kasan_check_byte include/linux/kasan.h:402 [inline] 
lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842 
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] 
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166 
rtlock_slowlock kernel/locking/rtmutex.c:1913 [inline] 
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline] 
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline] 
rt_spin_lock+0x157/0x400 kernel/locking/spinlock_rt.c:57 
spin_lock include/linux/spinlock_rt.h:45 [inline] 
__wake_up_common_lock+0x2f/0x1e0 kernel/sched/wait.c:124 
blk_update_request+0x57e/0xe60 block/blk-mq.c:1016 
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178 
blk_complete_reqs block/blk-mq.c:1253 [inline] 
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258 
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 
__do_softirq kernel/softirq.c:656 [inline] 
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302 
local_bh_enable include/linux/bottom_half.h:33 [inline] 
spin_unlock_bh include/linux/spinlock_rt.h:116 [inline] 
__fib6_clean_all+0x4d1/0x610 net/ipv6/ip6_fib.c:2325 
rt6_sync_down_dev net/ipv6/route.c:5018 [inline] 
rt6_disable_ip+0x11f/0x750 net/ipv6/route.c:5023 
addrconf_ifdown+0x157/0x1aa0 net/ipv6/addrconf.c:3865 
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 
notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85 
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline] 
call_netdevice_notifiers net/core/dev.c:2301 [inline] 
netif_close_many+0x2ae/0x420 net/core/dev.c:1805 
unregister_netdevice_many_notify+0xb50/0x22b0 net/core/dev.c:12388 
unregister_netdevice_many net/core/dev.c:12481 [inline] 
default_device_exit_batch+0x981/0xa00 net/core/dev.c:13073 
ops_exit_list net/core/net_namespace.c:205 [inline] 
ops_undo_list+0x52b/0x940 net/core/net_namespace.c:252 
cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 
process_one_work kernel/workqueue.c:3302 [inline] 
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385 
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466 
kthread+0x388/0x470 kernel/kthread.c:436 
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 
</TASK> 

Allocated by task 8907: 
kasan_save_stack mm/kasan/common.c:57 [inline] 
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 
poison_kmalloc_redzone mm/kasan/common.c:398 [inline] 
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 
kasan_kmalloc include/linux/kasan.h:263 [inline] 
__kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419 
kmalloc_noprof include/linux/slab.h:950 [inline] 
kzalloc_noprof include/linux/slab.h:1188 [inline] 
open_inline_log fs/jfs/jfs_logmgr.c:1157 [inline] 
lmLogOpen+0x2d1/0xfa0 fs/jfs/jfs_logmgr.c:1067 
jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257 
jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532 
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694 
vfs_get_tree+0x92/0x2a0 fs/super.c:1754 
fc_mount fs/namespace.c:1193 [inline] 
do_new_mount_fc fs/namespace.c:3758 [inline] 
do_new_mount+0x341/0xd30 fs/namespace.c:3834 
do_mount fs/namespace.c:4167 [inline] 
__do_sys_mount fs/namespace.c:4383 [inline] 
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360 
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] 
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 
entry_SYSCALL_64_after_hwframe+0x77/0x7f 

Freed by task 8892: 
kasan_save_stack mm/kasan/common.c:57 [inline] 
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 
poison_slab_object mm/kasan/common.c:253 [inline] 
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 
kasan_slab_free include/linux/kasan.h:235 [inline] 
slab_free_hook mm/slub.c:2689 [inline] 
slab_free mm/slub.c:6250 [inline] 
kfree+0x1c5/0x6c0 mm/slub.c:6565 
lmLogClose+0x297/0x520 fs/jfs/jfs_logmgr.c:-1 
jfs_umount+0x304/0x3e0 fs/jfs/jfs_umount.c:131 
jfs_put_super+0x8c/0x190 fs/jfs/super.c:194 
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646 
kill_block_super+0x44/0x90 fs/super.c:1725 
deactivate_locked_super+0xbc/0x130 fs/super.c:476 
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312 
task_work_run+0x1d9/0x270 kernel/task_work.c:233 
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] 
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline] 
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98 
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] 
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 
[inline] 
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] 
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 
entry_SYSCALL_64_after_hwframe+0x77/0x7f 

The buggy address belongs to the object at ffff88802a964000 
which belongs to the cache kmalloc-2k of size 2048 
The buggy address is located 256 bytes inside of 
freed 2048-byte region [ffff88802a964000, ffff88802a964800) 

The buggy address belongs to the physical page: 
page: refcount:0 mapcount:0 mapping:0000000000000000 
index:0xffff88802a961000 pfn:0x2a960 
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 
flags: 0x80000000000240(workingset|head|node=0|zone=1) 
page_type: f5(slab) 
raw: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 
raw: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 
head: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 
head: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 
head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff 
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 
page dumped because: kasan: bad access detected 
page_owner tracks the page as allocated 
page last allocated via order 3, migratetype Unmovable, gfp_mask 
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), 
pid 1, tgid 1 (swapper/0), ts 11357773279, free_ts 0 
set_page_owner include/linux/page_owner.h:32 [inline] 
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858 
prep_new_page mm/page_alloc.c:1866 [inline] 
get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946 
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226 
alloc_slab_page mm/slub.c:3278 [inline] 
allocate_slab+0x77/0x660 mm/slub.c:3467 
new_slab mm/slub.c:3525 [inline] 
refill_objects+0x33c/0x3d0 mm/slub.c:7255 
refill_sheaf mm/slub.c:2816 [inline] 
__pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651 
alloc_from_pcs mm/slub.c:4749 [inline] 
slab_alloc_node mm/slub.c:4883 [inline] 
__kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414 
kmalloc_noprof include/linux/slab.h:950 [inline] 
kzalloc_noprof include/linux/slab.h:1188 [inline] 
hub_probe+0x571/0x3c30 drivers/usb/core/hub.c:1961 
usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396 
call_driver_probe drivers/base/dd.c:-1 [inline] 
really_probe+0x267/0xaf0 drivers/base/dd.c:709 
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871 
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901 
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029 
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101 
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156 
page_owner free stack trace missing 

Memory state around the buggy address: 
ffff88802a964000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 
ffff88802a964080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 
>ffff88802a964100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 
^ 
ffff88802a964180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 
ffff88802a964200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 
================================================================== 


Tested on: 

commit: a293ec25 Merge tag 'linux_kselftest-fixes-7.1-rc3' of .. 
git tree: upstream 
console output: https://syzkaller.appspot.com/x/log.txt?x=146a4ad2580000 
kernel config: https://syzkaller.appspot.com/x/.config?x=f2e8ebfec4636d32 
dashboard link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8 
compiler: Debian clang version 21.1.8 
(++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 
patch: https://syzkaller.appspot.com/x/patch.diff?x=171e59ce580000