BUG: spinlock bad magic on CPU#1, jfsCommit/248 lock: 0xffff0000e222c168, .magic: ffff8000, .owner: @É"â/0, .owner_cpu: 512 CPU: 1 PID: 248 Comm: jfsCommit Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: dump_backtrace+0x0/0x458 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 spin_dump+0x110/0x208 kernel/locking/spinlock_debug.c:69 spin_bug kernel/locking/spinlock_debug.c:77 [inline] debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] do_raw_spin_lock+0x1f0/0x2fc kernel/locking/spinlock_debug.c:114 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x148 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe0/0x174 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x8f8 fs/jfs/jfs_metapage.c:737 xtTruncate+0xb98/0x26f8 fs/jfs/jfs_xtree.c:-1 jfs_free_zero_link+0x2c0/0x42c fs/jfs/namei.c:758 jfs_evict_inode+0x2fc/0x3f4 fs/jfs/inode.c:159 evict+0x3e0/0x828 fs/inode.c:647 iput_final fs/inode.c:1769 [inline] iput+0x6ac/0x764 fs/inode.c:1795 txUpdateMap+0x69c/0x7bc fs/jfs/jfs_txnmgr.c:2402 txLazyCommit fs/jfs/jfs_txnmgr.c:2699 [inline] jfs_lazycommit+0x360/0x9b0 fs/jfs/jfs_txnmgr.c:2767 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:856 ================================================================================ UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9 index 1114 is out of range for type 'unsigned long[8]' CPU: 1 PID: 248 Comm: jfsCommit Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: dump_backtrace+0x0/0x458 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151 __ubsan_handle_out_of_bounds+0xd4/0x100 lib/ubsan.c:282 decode_tail kernel/locking/qspinlock.c:130 [inline] queued_spin_lock_slowpath+0x73c/0x7ac kernel/locking/qspinlock.c:468 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x2f8/0x2fc kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x148 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe0/0x174 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x8f8 fs/jfs/jfs_metapage.c:737 xtTruncate+0xb98/0x26f8 fs/jfs/jfs_xtree.c:-1 jfs_free_zero_link+0x2c0/0x42c fs/jfs/namei.c:758 jfs_evict_inode+0x2fc/0x3f4 fs/jfs/inode.c:159 evict+0x3e0/0x828 fs/inode.c:647 iput_final fs/inode.c:1769 [inline] iput+0x6ac/0x764 fs/inode.c:1795 txUpdateMap+0x69c/0x7bc fs/jfs/jfs_txnmgr.c:2402 txLazyCommit fs/jfs/jfs_txnmgr.c:2699 [inline] jfs_lazycommit+0x360/0x9b0 fs/jfs/jfs_txnmgr.c:2767 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:856 ================================================================================ ================================================================== BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x480/0x7ac kernel/locking/qspinlock.c:471 Write of size 8 at addr ffff000021746714 by task jfsCommit/248 CPU: 1 PID: 248 Comm: jfsCommit Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: dump_backtrace+0x0/0x458 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x158 mm/kasan/report.c:451 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314 queued_spin_lock_slowpath+0x480/0x7ac kernel/locking/qspinlock.c:471 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x2f8/0x2fc kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x148 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe0/0x174 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x8f8 fs/jfs/jfs_metapage.c:737 xtTruncate+0xb98/0x26f8 fs/jfs/jfs_xtree.c:-1 jfs_free_zero_link+0x2c0/0x42c fs/jfs/namei.c:758 jfs_evict_inode+0x2fc/0x3f4 fs/jfs/inode.c:159 evict+0x3e0/0x828 fs/inode.c:647 iput_final fs/inode.c:1769 [inline] iput+0x6ac/0x764 fs/inode.c:1795 txUpdateMap+0x69c/0x7bc fs/jfs/jfs_txnmgr.c:2402 txLazyCommit fs/jfs/jfs_txnmgr.c:2699 [inline] jfs_lazycommit+0x360/0x9b0 fs/jfs/jfs_txnmgr.c:2767 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:856 The buggy address belongs to the page: page:0000000061a9b2d9 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61746 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) raw: 01ffc00000000000 fffffc000085d188 fffffc000085d188 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000021746600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000021746680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff000021746700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000021746780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000021746800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================