... Log Wrap ... Log Wrap ... Log Wrap ... ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_write include/linux/instrumented.h:82 [inline] BUG: KASAN: slab-use-after-free in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: slab-use-after-free in txEnd+0x328/0x558 fs/jfs/jfs_txnmgr.c:554 Write of size 8 at addr ffff0000ca3be040 by task jfsCommit/97 CPU: 0 PID: 97 Comm: jfsCommit Not tainted 6.9.0-rc3-syzkaller-gfec50db7033e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x198/0x538 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:82 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] txEnd+0x328/0x558 fs/jfs/jfs_txnmgr.c:554 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline] jfs_lazycommit+0x4e0/0x9a8 fs/jfs/jfs_txnmgr.c:2733 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Allocated by task 6380: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x264/0x3f0 mm/slub.c:3997 kmalloc include/linux/slab.h:628 [inline] kzalloc include/linux/slab.h:749 [inline] open_inline_log fs/jfs/jfs_logmgr.c:1159 [inline] lmLogOpen+0x294/0xdb4 fs/jfs/jfs_logmgr.c:1069 jfs_mount_rw+0xe4/0x5b8 fs/jfs/jfs_mount.c:257 jfs_fill_super+0x4f0/0x9f0 fs/jfs/super.c:565 mount_bdev+0x1d4/0x2a0 fs/super.c:1658 jfs_do_mount+0x44/0x58 fs/jfs/super.c:670 legacy_get_tree+0xd4/0x16c fs/fs_context.c:662 vfs_get_tree+0x90/0x288 fs/super.c:1779 do_new_mount+0x278/0x900 fs/namespace.c:3352 path_mount+0x590/0xe04 fs/namespace.c:3679 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount fs/namespace.c:3875 [inline] __arm64_sys_mount+0x45c/0x594 fs/namespace.c:3875 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Freed by task 6277: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:579 poison_slab_object+0x124/0x18c mm/kasan/common.c:240 __kasan_slab_free+0x3c/0x70 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x150/0x3e8 mm/slub.c:4390 lmLogClose+0x270/0x4d4 jfs_umount+0x274/0x360 fs/jfs/jfs_umount.c:114 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x128/0x2b8 fs/super.c:641 kill_block_super+0x44/0x90 fs/super.c:1675 deactivate_locked_super+0xc4/0x12c fs/super.c:472 deactivate_super+0xe0/0x100 fs/super.c:505 cleanup_mnt+0x34c/0x3dc fs/namespace.c:1267 __cleanup_mnt+0x20/0x30 fs/namespace.c:1274 task_work_run+0x230/0x2e0 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] do_notify_resume+0x178/0x1f4 arch/arm64/kernel/entry-common.c:151 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xac/0x168 arch/arm64/kernel/entry-common.c:713 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The buggy address belongs to the object at ffff0000ca3be000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 64 bytes inside of freed 1024-byte region [ffff0000ca3be000, ffff0000ca3be400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a3b8 head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x5ffe00000000840(slab|head|node=0|zone=2|lastcpupid=0xfff) page_type: 0xffffffff() raw: 05ffe00000000840 ffff0000c0001dc0 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 head: 05ffe00000000840 ffff0000c0001dc0 0000000000000000 0000000000000001 head: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 head: 05ffe00000000003 fffffdffc328ee01 fffffdffc328ee48 00000000ffffffff head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ca3bdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000ca3bdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000ca3be000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000ca3be080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000ca3be100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ...