================================================================== BUG: KASAN: use-after-free in jfs_lazycommit+0x74f/0xa50 fs/jfs/jfs_txnmgr.c:2735 Read of size 4 at addr ffff888079bece94 by task jfsCommit/107 CPU: 0 PID: 107 Comm: jfsCommit Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0xa8/0x210 mm/kasan/report.c:420 kasan_report+0x10b/0x140 mm/kasan/report.c:524 jfs_lazycommit+0x74f/0xa50 fs/jfs/jfs_txnmgr.c:2735 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 10824: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] jfs_fill_super+0xd2/0xac0 fs/jfs/super.c:495 mount_bdev+0x287/0x3c0 fs/super.c:1443 legacy_get_tree+0xe6/0x180 fs/fs_context.c:632 vfs_get_tree+0x88/0x270 fs/super.c:1573 do_new_mount+0x24a/0xa40 fs/namespace.c:3069 do_mount fs/namespace.c:3412 [inline] __do_sys_mount fs/namespace.c:3620 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3597 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 8604: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2d/0x50 mm/kasan/generic.c:516 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1729 [inline] slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1755 slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700 generic_shutdown_super+0x130/0x340 fs/super.c:501 kill_block_super+0x7c/0xe0 fs/super.c:1470 deactivate_locked_super+0x93/0xf0 fs/super.c:332 cleanup_mnt+0x463/0x4f0 fs/namespace.c:1182 task_work_run+0x1ca/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486 call_rcu+0x154/0x980 kernel/rcu/tree.c:2849 fib_create_info+0x1871/0x2490 net/ipv4/fib_semantics.c:1591 fib_table_insert+0xc3/0x1b50 net/ipv4/fib_trie.c:1217 fib_magic+0x2c1/0x390 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x3f7/0x5e0 net/ipv4/fib_frontend.c:1162 fib_inetaddr_event+0x13c/0x1c0 net/ipv4/fib_frontend.c:1454 notifier_call_chain kernel/notifier.c:87 [inline] blocking_notifier_call_chain+0x103/0x1b0 kernel/notifier.c:382 __inet_insert_ifa+0x9aa/0xb60 net/ipv4/devinet.c:568 inet_rtm_newaddr+0x930/0x1890 net/ipv4/devinet.c:970 rtnetlink_rcv_msg+0x79b/0xed0 net/core/rtnetlink.c:6153 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x59b/0x970 net/socket.c:2519 ___sys_sendmsg+0x21c/0x290 net/socket.c:2573 __sys_sendmsg net/socket.c:2602 [inline] __do_sys_sendmsg net/socket.c:2611 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2609 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Second to last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486 kvfree_call_rcu+0x108/0x870 kernel/rcu/tree.c:3405 ip_mc_destroy_dev+0x55/0x360 net/ipv4/igmp.c:1813 inetdev_destroy net/ipv4/devinet.c:320 [inline] inetdev_event+0x4f5/0x1410 net/ipv4/devinet.c:1615 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:455 call_netdevice_notifiers_mtu net/core/dev.c:2076 [inline] dev_set_mtu_ext+0x432/0x610 net/core/dev.c:8780 do_setlink+0x8ee/0x3c40 net/core/rtnetlink.c:2796 rtnl_setlink+0x35b/0x450 net/core/rtnetlink.c:3124 rtnetlink_rcv_msg+0x79b/0xed0 net/core/rtnetlink.c:6153 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] sock_write_iter+0x2b5/0x3a0 net/socket.c:1143 do_iter_readv_writev fs/read_write.c:-1 [inline] do_iter_write+0x62d/0xaf0 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_writev+0x24e/0x410 fs/read_write.c:977 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff888079bece00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 148 bytes inside of 256-byte region [ffff888079bece00, ffff888079becf00) The buggy address belongs to the physical page: page:ffffea0001e6fb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79bec head:ffffea0001e6fb00 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea000150a980 dead000000000003 ffff888017441b40 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2, tgid 2 (kthreadd), ts 79229010860, free_ts 79134172080 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532 prep_new_page mm/page_alloc.c:2539 [inline] get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5614 alloc_slab_page+0x5d/0x160 mm/slub.c:1799 allocate_slab mm/slub.c:1944 [inline] new_slab+0x87/0x2c0 mm/slub.c:1997 ___slab_alloc+0xbc6/0x1230 mm/slub.c:3154 __slab_alloc mm/slub.c:3240 [inline] slab_alloc_node mm/slub.c:3325 [inline] __kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3398 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] set_kthread_struct+0xb3/0x1f0 kernel/kthread.c:117 copy_process+0x130e/0x4020 kernel/fork.c:2278 kernel_clone+0x225/0x8b0 kernel/fork.c:2757 kernel_thread+0xe5/0x140 kernel/fork.c:2817 create_kthread kernel/kthread.c:399 [inline] kthreadd+0x536/0x6e0 kernel/kthread.c:748 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1459 [inline] free_pcp_prepare mm/page_alloc.c:1509 [inline] free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3479 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737 slab_alloc_node mm/slub.c:3359 [inline] kmem_cache_alloc_node+0x14d/0x320 mm/slub.c:3404 __alloc_skb+0xfc/0x7e0 net/core/skbuff.c:505 alloc_skb include/linux/skbuff.h:1271 [inline] nlmsg_new include/net/netlink.h:991 [inline] devlink_trap_group_notify+0x62/0x1b0 net/devlink/leftover.c:11744 devlink_notify_register net/devlink/leftover.c:9686 [inline] devlink_register+0x1da/0x3f0 net/devlink/leftover.c:9753 nsim_drv_probe+0x9b5/0xaf0 drivers/net/netdevsim/dev.c:1615 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429 Memory state around the buggy address: ffff888079becd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888079bece00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888079bece80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888079becf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888079becf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================