BUG: spinlock bad magic on CPU#1, jfsCommit/240 lock: 0xffff0000d3d789e8, .magic: ffff8000, .owner: À‘×Ó/0, .owner_cpu: 512 CPU: 1 PID: 240 Comm: jfsCommit Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 spin_dump kernel/locking/spinlock_debug.c:69 [inline] spin_bug+0x124/0x240 kernel/locking/spinlock_debug.c:77 debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] do_raw_spin_lock+0x200/0x35c kernel/locking/spinlock_debug.c:114 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 txUpdateMap+0x76c/0x914 fs/jfs/jfs_txnmgr.c:2401 txLazyCommit fs/jfs/jfs_txnmgr.c:2698 [inline] jfs_lazycommit+0x3b0/0xa40 fs/jfs/jfs_txnmgr.c:2766 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ================================================================================ UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9 index 1150 is out of range for type 'unsigned long[8]' CPU: 1 PID: 240 Comm: jfsCommit Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0x108/0x15c lib/ubsan.c:282 decode_tail kernel/locking/qspinlock.c:130 [inline] queued_spin_lock_slowpath+0x854/0x938 kernel/locking/qspinlock.c:468 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 txUpdateMap+0x76c/0x914 fs/jfs/jfs_txnmgr.c:2401 txLazyCommit fs/jfs/jfs_txnmgr.c:2698 [inline] jfs_lazycommit+0x3b0/0xa40 fs/jfs/jfs_txnmgr.c:2766 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 ================================================================================ ================================================================== BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471 Write of size 8 at addr ffff000027884e90 by task jfsCommit/240 CPU: 1 PID: 240 Comm: jfsCommit Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x174/0x1e4 mm/kasan/report.c:451 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314 queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 txUpdateMap+0x76c/0x914 fs/jfs/jfs_txnmgr.c:2401 txLazyCommit fs/jfs/jfs_txnmgr.c:2698 [inline] jfs_lazycommit+0x3b0/0xa40 fs/jfs/jfs_txnmgr.c:2766 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 The buggy address belongs to the page: page:00000000a402337e refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x67884 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) raw: 01ffc00000000000 fffffc00009e2108 fffffc00009e2108 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000027884d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000027884e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff000027884e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000027884f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000027884f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================