kernel BUG in jffs2_garbage_collect_pass

Status: upstream: reported on 2026/08/10 00:25
Subsystems: jffs2
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+9bbc6788187abbabb2ee@syzkaller.appspotmail.com
First crash: 5d23h, last: 9h11m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
738965a4 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ kernel BUG in jffs2_garbage_collect_pass 2026/08/09 10:15 2026/08/09 10:15 2026/08/09 10:53 5d63f80b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [jffs2?] kernel BUG in jffs2_garbage_collect_pass 0 (1) 2026/08/10 00:25

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/jffs2/gc.c:226!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 12631 Comm: jffs2_gcd_mtd0 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:jffs2_garbage_collect_pass+0x20e7/0x2170 fs/jffs2/gc.c:226
Code: 24 ee fd 48 8b 7c 24 20 e8 46 d9 99 08 90 0f 0b e8 de 6b 8d fe bf 02 00 00 00 e8 74 d5 5a fe e9 9d e7 ff ff e8 ca 6b 8d fe 90 <0f> 0b e8 c2 6b 8d fe bf 02 00 00 00 e8 58 d5 5a fe e9 7a f8 ff ff
RSP: 0018:ffffc9000354faa0 EFLAGS: 00010293
RAX: ffffffff83399596 RBX: 0000000000000006 RCX: ffff88807fddbe00
RDX: 0000000000000000 RSI: ffffffff8ef9c800 RDI: 0000000000000006
RBP: ffffc9000354fc70 R08: ffff88807fddbe00 R09: 0000000000000006
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888078d7a358
R13: ffff888074984540 R14: 1ffff1100e9308aa R15: ffff888074984552
FS:  0000000000000000(0000) GS:ffff888125055000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f661e1bb6b0 CR3: 0000000059513000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 jffs2_garbage_collect_thread+0x634/0x6c0 fs/jffs2/background.c:155
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jffs2_garbage_collect_pass+0x20e7/0x2170 fs/jffs2/gc.c:226
Code: 24 ee fd 48 8b 7c 24 20 e8 46 d9 99 08 90 0f 0b e8 de 6b 8d fe bf 02 00 00 00 e8 74 d5 5a fe e9 9d e7 ff ff e8 ca 6b 8d fe 90 <0f> 0b e8 c2 6b 8d fe bf 02 00 00 00 e8 58 d5 5a fe e9 7a f8 ff ff
RSP: 0018:ffffc9000354faa0 EFLAGS: 00010293
RAX: ffffffff83399596 RBX: 0000000000000006 RCX: ffff88807fddbe00
RDX: 0000000000000000 RSI: ffffffff8ef9c800 RDI: 0000000000000006
RBP: ffffc9000354fc70 R08: ffff88807fddbe00 R09: 0000000000000006
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888078d7a358
R13: ffff888074984540 R14: 1ffff1100e9308aa R15: ffff888074984552
FS:  0000000000000000(0000) GS:ffff888125055000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f661e1bb6b0 CR3: 0000000059513000 CR4: 0000000000350ef0

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/10 14:16 upstream db2ddb871435 558388e4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in jffs2_garbage_collect_pass
2026/08/04 23:46 upstream 562bfb501c54 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in jffs2_garbage_collect_pass
* Struck through repros no longer work on HEAD.