KASAN: use-after-free Read in jfs

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
6ecc4566-578e-4388-8f84-469c86f33649	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	KASAN: use-after-free Read in jfs_lazycommit	2026/05/30 10:25	2026/05/30 10:25	2026/05/30 11:10	6b4a844333e83556da95d61d7f207e7ef5cd4bc6
4bafa449-714e-4d1f-a32f-df0129b9c267	assessment-security		💥	KASAN: use-after-free Read in jfs_lazycommit	2026/05/14 09:36	2026/05/14 09:36	2026/05/14 09:38	6ccb967e465e832a7bfd7a116ad00d52a0923a5d	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/f69ddb7e99c347c6ef... truncated to first 200 bytes; open job for full error

Title	Replies (including bot)	Last reply
[syzbot] KASAN: use-after-free Read in jfs_lazycommit	1 (10)	2026/05/06 11:50
[syzbot] [jfs?] KASAN: slab-use-after-free Read in jfs_syncpt	2 (8)	2026/05/05 12:34
[PATCH v2 2/2] jfs: wait for in-flight log I/O before freeing lbufs in lbmLogShutdown	1 (1)	2026/05/05 12:33
[PATCH v2 1/2] jfs: drain lazy commit queue during unmount to prevent use-after-free	1 (1)	2026/05/05 12:33
[PATCH] jfs: drain lazy commit queue during unmount to prevent use-after-free	2 (2)	2026/05/05 12:33
[syzbot] Monthly jfs report (Apr 2026)	0 (1)	2026/04/29 20:32
[syzbot] Monthly jfs report (Mar 2026)	0 (1)	2026/03/31 08:07
[syzbot] Monthly jfs report (Dec 2025)	0 (1)	2025/12/26 07:48
[PATCH] jfs: Fix use-after-free read issue in jfs_lazycommit	2 (2)	2024/10/30 14:30

Title

Replies (including bot)

Last reply

[syzbot] KASAN: use-after-free Read in jfs_lazycommit

1 (10)

2026/05/06 11:50

[syzbot] [jfs?] KASAN: slab-use-after-free Read in jfs_syncpt

2 (8)

2026/05/05 12:34

[PATCH v2 2/2] jfs: wait for in-flight log I/O before freeing lbufs in lbmLogShutdown

1 (1)

2026/05/05 12:33

[PATCH v2 1/2] jfs: drain lazy commit queue during unmount to prevent use-after-free

1 (1)

2026/05/05 12:33

[PATCH] jfs: drain lazy commit queue during unmount to prevent use-after-free

2 (2)

2026/05/05 12:33

[syzbot] Monthly jfs report (Apr 2026)

0 (1)

2026/04/29 20:32

[syzbot] Monthly jfs report (Mar 2026)

0 (1)

2026/03/31 08:07

[syzbot] Monthly jfs report (Dec 2025)

0 (1)

2025/12/26 07:48

[PATCH] jfs: Fix use-after-free read issue in jfs_lazycommit

2 (2)

2024/10/30 14:30

Kernel	Title	Rank 🛈	Repro	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: use-after-free Read in jfs_lazycommit jfs	19	C	error	5	1257d	1374d	0/1	upstream: reported C repro on 2022/10/13 08:33
linux-6.1	KASAN: use-after-free Read in jfs_lazycommit origin:upstream missing-backport	19	C	inconclusive	398	1d21h	1167d	0/3	upstream: reported C repro on 2023/05/07 23:35
linux-5.15	KASAN: use-after-free Read in jfs_lazycommit origin:upstream	19	C	error	434	8d04h	1169d	0/3	upstream: reported C repro on 2023/05/06 12:04
linux-4.14	KASAN: use-after-free Read in jfs_lazycommit jfs	19	C		6	1234d	1376d	0/1	upstream: reported C repro on 2022/10/11 20:09
linux-6.6	KASAN: slab-use-after-free Read in jfs_lazycommit origin:upstream	19	C		145	11d	395d	0/2	upstream: reported C repro on 2025/06/18 00:01

Rank 🛈

linux-4.19

KASAN: use-after-free Read in jfs_lazycommit jfs

error

1257d

1374d

0/1

upstream: reported C repro on 2022/10/13 08:33

linux-6.1

KASAN: use-after-free Read in jfs_lazycommit origin:upstream missing-backport

inconclusive

398

1d21h

1167d

0/3

upstream: reported C repro on 2023/05/07 23:35

linux-5.15

KASAN: use-after-free Read in jfs_lazycommit origin:upstream

error

434

8d04h

1169d

0/3

upstream: reported C repro on 2023/05/06 12:04

linux-4.14

KASAN: use-after-free Read in jfs_lazycommit jfs

1234d

1376d

0/1

upstream: reported C repro on 2022/10/11 20:09

linux-6.6

KASAN: slab-use-after-free Read in jfs_lazycommit origin:upstream

145

11d

395d

0/2

upstream: reported C repro on 2025/06/18 00:01

Created	Duration	User	Patch	Repo	Result
2026/05/06 11:50	39m	tristmd@gmail.com	patch	upstream	error
2026/05/05 12:34	27m	tristmd@gmail.com	patch	upstream	report log
2026/05/04 22:42	22m	tristmd@gmail.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	report log
2026/04/30 23:13	21m	tristmd@gmail.com	patch	upstream	report log
2024/10/13 03:30	1h14m	qianqiang.liu@163.com	patch	upstream	OK log
2024/01/08 22:50	35m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	report log
2024/01/08 22:50	25m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	report log
2024/01/08 21:54	32m	retest repro		upstream	OK log
2024/01/08 21:54	19m	retest repro		upstream	OK log
2023/10/01 14:38	14m	retest repro		upstream	report log
2023/10/01 14:38	22m	retest repro		upstream	report log

Created

Duration

User

Patch

Repo

Result

2026/05/06 11:50

39m

tristmd@gmail.com

patch

upstream

error

2026/05/05 12:34

27m

tristmd@gmail.com

patch

upstream

report log

2026/05/04 22:42

22m

tristmd@gmail.com

patch

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

report log

2026/04/30 23:13

21m

tristmd@gmail.com

patch

upstream

report log

2024/10/13 03:30

1h14m

qianqiang.liu@163.com

patch

upstream

OK log

2024/01/08 22:50

35m

retest repro

git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

report log

2024/01/08 22:50

25m

retest repro

git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

report log

2024/01/08 21:54

32m

retest repro

upstream

OK log

2024/01/08 21:54

19m

retest repro

upstream

OK log

2023/10/01 14:38

14m

retest repro

upstream

report log

2023/10/01 14:38

22m

retest repro

upstream

report log

Created	Duration	User	Patch	Repo	Result
2023/04/03 16:43	56m	bisect fix		upstream	OK (0) job log log

Created

Duration

User

Patch

Repo

Result

2023/04/03 16:43

56m

bisect fix

upstream

OK (0) job log log

blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map ================================================================== BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 Read of size 4 at addr ffff88807a425894 by task jfsCommit/119 CPU: 1 UID: 0 PID: 119 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 5866: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634 vfs_get_tree+0x92/0x320 fs/super.c:1694 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3765 [inline] do_new_mount fs/namespace.c:3841 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4161 do_mount fs/namespace.c:4174 [inline] __do_sys_mount fs/namespace.c:4390 [inline] __se_sys_mount fs/namespace.c:4367 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4367 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5761: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kfree+0x22b/0x6c0 mm/slub.c:6720 generic_shutdown_super+0x167/0x360 fs/super.c:647 kill_block_super+0x3b/0xa0 fs/super.c:1665 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477 deactivate_super fs/super.c:510 [inline] deactivate_super+0xe7/0x110 fs/super.c:506 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807a425800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 148 bytes inside of freed 256-byte region [ffff88807a425800, ffff88807a425900) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a424 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5761, tgid 5761 (syz-executor), ts 123295058693, free_ts 123178910398 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3294 [inline] allocate_slab mm/slub.c:3408 [inline] new_slab+0xa2/0x650 mm/slub.c:3454 refill_objects+0xe3/0x410 mm/slub.c:7338 refill_sheaf mm/slub.c:2832 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703 alloc_from_pcs mm/slub.c:4801 [inline] slab_alloc_node mm/slub.c:4933 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5511 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] ____ip_mc_inc_group+0x40b/0x10d0 net/ipv4/igmp.c:1563 __ip_mc_inc_group net/ipv4/igmp.c:1601 [inline] ip_mc_inc_group net/ipv4/igmp.c:1607 [inline] ip_mc_up+0x154/0x390 net/ipv4/igmp.c:1912 inetdev_event+0x6c3/0x17f0 net/ipv4/devinet.c:1630 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] __dev_notify_flags+0x12c/0x2e0 net/core/dev.c:9793 netif_change_flags+0x108/0x160 net/core/dev.c:9822 do_setlink.isra.0+0x1ac4/0x3e60 net/core/rtnetlink.c:3215 rtnl_changelink net/core/rtnetlink.c:3849 [inline] __rtnl_newlink net/core/rtnetlink.c:4022 [inline] rtnl_newlink+0x11c2/0x2380 net/core/rtnetlink.c:4159 page last free pid 64 tgid 64 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4612 [inline] slab_alloc_node mm/slub.c:4945 [inline] __kmalloc_cache_noprof+0x265/0x6c0 mm/slub.c:5511 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] mca_alloc net/ipv6/mcast.c:871 [inline] __ipv6_dev_mc_inc+0x2f1/0xbd0 net/ipv6/mcast.c:961 addrconf_join_solict net/ipv6/addrconf.c:2262 [inline] addrconf_dad_begin net/ipv6/addrconf.c:4134 [inline] addrconf_dad_work+0x276/0x1360 net/ipv6/addrconf.c:4262 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88807a425780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807a425800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807a425880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807a425900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807a425980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map ================================================================== BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 Read of size 4 at addr ffff88802a3bc294 by task jfsCommit/119 CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 5883: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634 vfs_get_tree+0x92/0x320 fs/super.c:1694 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3765 [inline] do_new_mount fs/namespace.c:3841 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4161 do_mount fs/namespace.c:4174 [inline] __do_sys_mount fs/namespace.c:4390 [inline] __se_sys_mount fs/namespace.c:4367 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4367 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5761: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kfree+0x22b/0x6c0 mm/slub.c:6720 generic_shutdown_super+0x167/0x360 fs/super.c:647 kill_block_super+0x3b/0xa0 fs/super.c:1665 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477 deactivate_super fs/super.c:510 [inline] deactivate_super+0xe7/0x110 fs/super.c:506 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802a3bc200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 148 bytes inside of freed 256-byte region [ffff88802a3bc200, ffff88802a3bc300) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a3bc800 pfn:0x2a3bc head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910 raw: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000 head: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910 head: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12389696697, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3294 [inline] allocate_slab mm/slub.c:3408 [inline] new_slab+0xa2/0x650 mm/slub.c:3454 refill_objects+0xe3/0x410 mm/slub.c:7338 refill_sheaf mm/slub.c:2832 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703 alloc_from_pcs mm/slub.c:4801 [inline] slab_alloc_node mm/slub.c:4933 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5511 _kmalloc_noprof include/linux/slab.h:969 [inline] usb_string+0x10f/0x570 drivers/usb/core/message.c:1038 usb_cache_string+0x7c/0x100 drivers/usb/core/message.c:1090 usb_enumerate_device drivers/usb/core/hub.c:2540 [inline] usb_new_device+0x239/0x7d0 drivers/usb/core/hub.c:2665 register_root_hub+0x4e6/0x639 drivers/usb/core/hcd.c:990 usb_add_hcd.cold+0xccd/0x1158 drivers/usb/core/hcd.c:2987 dummy_hcd_probe+0x189/0x2fa drivers/usb/gadget/udc/dummy_hcd.c:2708 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 page_owner free stack trace missing Memory state around the buggy address: ffff88802a3bc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802a3bc200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802a3bc280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802a3bc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802a3bc380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002c, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map blkno = 5002d, nblocks = 1 ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map ================================================================== BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 Read of size 4 at addr ffff8880319bac94 by task jfsCommit/119 CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 5890: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634 vfs_get_tree+0x92/0x320 fs/super.c:1694 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3765 [inline] do_new_mount fs/namespace.c:3841 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4161 do_mount fs/namespace.c:4174 [inline] __do_sys_mount fs/namespace.c:4390 [inline] __se_sys_mount fs/namespace.c:4367 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4367 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5761: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kfree+0x22b/0x6c0 mm/slub.c:6720 generic_shutdown_super+0x167/0x360 fs/super.c:647 kill_block_super+0x3b/0xa0 fs/super.c:1665 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477 deactivate_super fs/super.c:510 [inline] deactivate_super+0xe7/0x110 fs/super.c:506 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880319bac00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 148 bytes inside of freed 256-byte region [ffff8880319bac00, ffff8880319bad00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x319ba head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22136679680, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3294 [inline] allocate_slab mm/slub.c:3408 [inline] new_slab+0xa2/0x650 mm/slub.c:3454 refill_objects+0xe3/0x410 mm/slub.c:7338 refill_sheaf mm/slub.c:2832 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703 alloc_from_pcs mm/slub.c:4801 [inline] slab_alloc_node mm/slub.c:4933 [inline] __do_kmalloc_node mm/slub.c:5361 [inline] __kvmalloc_node_noprof+0x793/0x970 mm/slub.c:6933 v4l2_ctrl_new+0x4a6/0x23a0 drivers/media/v4l2-core/v4l2-ctrls-core.c:2152 v4l2_ctrl_new_std+0x1bb/0x290 drivers/media/v4l2-core/v4l2-ctrls-core.c:2306 handler_new_ref+0x82f/0xc60 drivers/media/v4l2-core/v4l2-ctrls-core.c:1887 v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2456 [inline] v4l2_ctrl_add_handler+0x223/0x300 drivers/media/v4l2-core/v4l2-ctrls-core.c:2430 vivid_create_controls+0x351e/0x3e80 drivers/media/test-drivers/vivid/vivid-ctrls.c:2085 vivid_create_instance drivers/media/test-drivers/vivid/vivid-core.c:1933 [inline] vivid_probe.cold+0x4f1e/0x921e drivers/media/test-drivers/vivid/vivid-core.c:2095 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 page_owner free stack trace missing Memory state around the buggy address: ffff8880319bab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880319bac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880319bac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880319bad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880319bad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================

Crashes (4187):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/07/15 19:13	upstream	58717b2a1365	209f0369	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2]	ci-upstream-kasan-badwrites-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/04/09 12:59	upstream	7f87a5ea75f0	38c8e246	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/07 21:29	upstream	4ae12d8bd9a8	5cb44a80	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/07 19:36	upstream	4ae12d8bd9a8	5cb44a80	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/25 22:09	upstream	d9d32e5bd5a4	94a9671e	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	general protection fault in jfs_lazycommit
2026/02/22 10:10	upstream	fa5c82f4d2bb	6e7b5511	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/02 01:55	upstream	b69053dd3ffb	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/11/09 06:20	upstream	7bb4d6512545	4e1406b4	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/10/21 01:57	upstream	211ddde0823f	d422939c	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	general protection fault in jfs_lazycommit
2025/09/15 12:52	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 11:12	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 09:43	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 08:16	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 06:51	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 05:27	upstream	f83ec76bf285	e2beed91	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/08/17 10:56	upstream	99bade344cfa	1804e95e	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	general protection fault in jfs_lazycommit
2025/07/29 13:48	upstream	ae388edd4a8f	c4a95487	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	general protection fault in jfs_lazycommit
2025/06/09 06:50	upstream	939f15e640f1	4826c28e	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/03/27 13:24	upstream	1e1ba8d23dae	20510e88	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/01/21 14:27	upstream	95ec54a420b8	6e87cfa2	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/11/22 06:21	upstream	28eb75e178d3	4b25d554	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/11/01 23:29	upstream	6c52d4da1c74	f00eed24	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/10/08 23:20	upstream	5b7c893ed5ed	402f1df0	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/31 17:27	upstream	ad9a728a3388	afc0c4d4	.config	console log	report	syz / log	C		[disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-snapshot-upstream-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/02/24 21:29	upstream	d082ecbc71e9	d34966d1	.config	console log	report	syz / log	C		[disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)]	ci-snapshot-upstream-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/19 00:11	linux-next	50f68cc7be0a	77d4d919	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/25 06:12	linux-next	b5a4da2c459f	0abd0691	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/06 21:29	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	59e4d31a0470	97745f52	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/02 06:03	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	59e4d31a0470	6b8752f2	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/17 17:22	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	59e4d31a0470	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 22:46	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 18:28	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 17:03	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 13:58	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 08:45	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 05:35	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 00:00	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2023/11/10 23:41	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8de1e7afcc1c	45e9b83e	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2023/05/07 17:49	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	14f8db1c0f9a	90c93c40	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/15 01:27	upstream	69237f8c1f69	ee8d34d6	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (corrupt fs)]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/31 15:49	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	8f0b4cce4481	d6526ea3	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/10/09 13:33	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	bf45a62baffc	7e2882b3	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/07/26 22:11	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	82af5ea7c611	fb8f743d	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/05/23 19:01	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	d7fa1af5b33e	f8cc0c83	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2025/03/16 21:58	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	a5618886fdab	e2826670	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)]	ci-upstream-gce-arm64	BUG: unable to handle kernel paging request in jfs_lazycommit
2022/11/11 11:47	upstream	4bbf3422df78	f42ee5d8	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-upstream-fs	KASAN: use-after-free Read in jfs_lazycommit
2022/10/12 05:32	upstream	493ffd6605b2	02b6492e	.config	console log	report	syz	C		[disk image] [vmlinux] [mounted in repro]	ci2-upstream-fs	KASAN: use-after-free Read in jfs_lazycommit
2024/04/27 00:13	upstream	c942a0cd3603	059e9963	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: use-after-free Read in jfs_lazycommit
2022/09/26 22:13	upstream	3800a713b607	10323ddf	.config	console log	report			info		ci-qemu-upstream	KASAN: use-after-free Read in jfs_lazycommit
2026/07/18 19:46	upstream	1229e2e57a5c	72524a66	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/17 22:48	upstream	111e7b23e5b0	8aaff637	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/17 12:34	upstream	fce2dfa773ce	7f27c57a	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/16 22:08	upstream	37e2f878a7a6	71b49442	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/16 20:46	upstream	37e2f878a7a6	71b49442	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/15 21:03	upstream	58717b2a1365	a4ed0f4f	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/15 05:09	upstream	7059bdf4f04a	2130f682	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/14 09:03	upstream	3b029c035b34	2130f682	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/14 05:14	upstream	3b029c035b34	2130f682	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/13 06:13	upstream	f4fb100039e9	d78ea535	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/11 18:07	upstream	dd3210c47e8d	d78ea535	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/11 15:28	upstream	61c03dfde854	d78ea535	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	general protection fault in jfs_lazycommit
2026/07/11 13:27	upstream	61c03dfde854	d78ea535	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/11 07:35	upstream	61c03dfde854	d78ea535	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/10 03:37	upstream	a635d6748234	4167ee25	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/09 04:24	upstream	0e35b9b6ec0f	b9f1ceaa	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/08 17:02	upstream	0e35b9b6ec0f	88a4b44c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/08 08:26	upstream	0e35b9b6ec0f	88a4b44c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/08 03:34	upstream	0e35b9b6ec0f	76cdc0c0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/07 17:00	upstream	0e35b9b6ec0f	88a4b44c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/07 14:05	upstream	0e35b9b6ec0f	76cdc0c0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/06 03:05	upstream	f105f3631d51	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/04 21:58	upstream	1e9cdc2ea15a	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/04 09:42	upstream	71dfdfb0209b	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/04 08:30	upstream	71dfdfb0209b	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/02 15:59	upstream	4a50a141f05a	2b70b115	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/02 08:29	upstream	4a50a141f05a	27192279	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/01 09:06	upstream	665159e24674	00a5cf1c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/01 06:33	upstream	665159e24674	00a5cf1c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/30 09:20	upstream	dc59e4fea9d8	fff8d0a0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/29 19:40	upstream	dc59e4fea9d8	6a0c72dc	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/29 13:10	upstream	dc59e4fea9d8	6a0c72dc	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/29 11:41	upstream	dc59e4fea9d8	6a0c72dc	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/29 05:34	upstream	dc59e4fea9d8	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/28 18:44	upstream	8b69c0475871	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/28 04:32	upstream	780d569e6c4b	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/27 06:44	upstream	5a66900afbd6	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/26 21:33	upstream	51cb1aa1250c	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/26 05:21	upstream	a142da0b2d32	7ff32d8b	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/25 10:51	upstream	ab9de95c9cf9	cfa969bf	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/24 07:19	upstream	558ef39aeb9a	042555ff	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-fs	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/24 02:22	upstream	f31c00c377cc	042555ff	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-badwrites-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/26 07:07	upstream	55027e689933	dec8bc94	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/24 23:07	upstream	626737a5791b	215eef4a	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/19 17:14	upstream	2ccbdf43d5e7	c2e07261	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/25 07:51	upstream	55027e689933	c2e07261	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/18 04:03	linux-next	cc2b5f627e8c	72524a66	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/13 21:40	linux-next	49362394dad7	a870962e	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/09 19:09	linux-next	b9810cd75b9f	b9f1ceaa	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/06 00:41	linux-next	2b763db0c276	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/07/05 01:49	linux-next	2b763db0c276	fcece630	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/27 17:25	linux-next	3d5670d672ae	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/06/26 23:14	linux-next	3d5670d672ae	fb92f11c	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KASAN: slab-use-after-free Read in jfs_lazycommit
2024/05/13 05:16	linux-next	75fa778d74b7	9026e142	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	KFENCE: use-after-free in jfs_lazycommit
2026/02/09 02:19	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	59e4d31a0470	4c131dc4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-gce-arm64	KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/19 20:41	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	59e4d31a0470	d6526ea3	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-gce-arm64	BUG: unable to handle kernel paging request in jfs_lazycommit

Crashes (4187):

Assets (help?)

2026/07/15 19:13

upstream