... Log Wrap ... Log Wrap ... Log Wrap ... ================================================================== BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: use-after-free in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: use-after-free in txEnd+0x2c4/0x510 fs/jfs/jfs_txnmgr.c:554 Write of size 8 at addr ffff0000ec37c840 by task jfsCommit/240 CPU: 1 PID: 240 Comm: jfsCommit Not tainted 5.15.186-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x270/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x44/0x54 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:86 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] txEnd+0x2c4/0x510 fs/jfs/jfs_txnmgr.c:554 txLazyCommit fs/jfs/jfs_txnmgr.c:2718 [inline] jfs_lazycommit+0x4a4/0x9bc fs/jfs/jfs_txnmgr.c:2766 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 Allocated by task 4281: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:735 [inline] open_inline_log fs/jfs/jfs_logmgr.c:1167 [inline] lmLogOpen+0x288/0xd68 fs/jfs/jfs_logmgr.c:1077 jfs_mount_rw+0xe4/0x50c fs/jfs/jfs_mount.c:253 jfs_fill_super+0x49c/0x960 fs/jfs/super.c:570 mount_bdev+0x264/0x358 fs/super.c:1400 jfs_do_mount+0x44/0x58 fs/jfs/super.c:675 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1530 do_new_mount+0x228/0x810 fs/namespace.c:3014 path_mount+0x5b4/0x1000 fs/namespace.c:3344 do_mount fs/namespace.c:3357 [inline] __do_sys_mount fs/namespace.c:3565 [inline] __se_sys_mount fs/namespace.c:3542 [inline] __arm64_sys_mount+0x514/0x5e4 fs/namespace.c:3542 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Freed by task 4158: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x84 mm/kasan/common.c:46 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0x170/0x40c mm/slub.c:4559 lmLogClose+0x250/0x4c8 fs/jfs/jfs_logmgr.c:-1 jfs_umount+0x244/0x328 fs/jfs/jfs_umount.c:116 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x2f0 fs/super.c:475 kill_block_super+0x70/0xdc fs/super.c:1427 deactivate_locked_super+0xb8/0x13c fs/super.c:335 deactivate_super+0xf8/0x118 fs/super.c:366 cleanup_mnt+0x3a4/0x458 fs/namespace.c:1139 __cleanup_mnt+0x20/0x30 fs/namespace.c:1146 task_work_run+0x12c/0x1e0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the object at ffff0000ec37c800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 64 bytes inside of 1024-byte region [ffff0000ec37c800, ffff0000ec37cc00) The buggy address belongs to the page: page:000000009900bd45 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c378 head:000000009900bd45 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002780 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ec37c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000ec37c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000ec37c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000ec37c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000ec37c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ... ... Log Wrap ... Log Wrap ... Log Wrap ...