KASAN: use-after-free Read in jfs_lazycommit

Status: upstream: reported C repro on 2022/10/01 13:43
Subsystems: jfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+885a4f3281b8d99c48d8@syzkaller.appspotmail.com
Fix commit: From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001
Patched on: [], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 1495d, last: 16h50m
Cause bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
6ecc4566 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: use-after-free Read in jfs_lazycommit 2026/05/30 10:25 2026/05/30 10:25 2026/05/30 11:10 6b4a8443
4bafa449 assessment-security 💥 KASAN: use-after-free Read in jfs_lazycommit 2026/05/14 09:36 2026/05/14 09:36 2026/05/14 09:38 6ccb967e
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[syzbot] KASAN: use-after-free Read in jfs_lazycommit 1 (17) 2026/10/26 15:22
[syzbot] [jfs?] KASAN: slab-use-after-free Read in jfs_syncpt 2 (8) 2026/05/05 12:34
[PATCH v2 2/2] jfs: wait for in-flight log I/O before freeing lbufs in lbmLogShutdown 1 (1) 2026/05/05 12:33
[PATCH v2 1/2] jfs: drain lazy commit queue during unmount to prevent use-after-free 1 (1) 2026/05/05 12:33
[PATCH] jfs: drain lazy commit queue during unmount to prevent use-after-free 2 (2) 2026/05/05 12:33
[syzbot] Monthly jfs report (Apr 2026) 0 (1) 2026/04/29 20:32
[syzbot] Monthly jfs report (Mar 2026) 0 (1) 2026/03/31 08:07
[syzbot] Monthly jfs report (Dec 2025) 0 (1) 2025/12/26 07:48
[PATCH] jfs: Fix use-after-free read issue in jfs_lazycommit 2 (2) 2024/10/30 14:30
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in jfs_lazycommit jfs 19 syz, C error 5 1361d 1478d 0/1 upstream: reported C repro on 2022/10/13 08:33
linux-6.1 KASAN: use-after-free Read in jfs_lazycommit origin:upstream missing-backport 19 syz, C inconclusive 460 10d 1272d 0/3 upstream: reported C repro on 2023/05/07 23:35
linux-5.15 KASAN: use-after-free Read in jfs_lazycommit origin:upstream 19 syz, C error 498 2d08h 1273d 0/3 upstream: reported C repro on 2023/05/06 12:04
linux-4.14 KASAN: use-after-free Read in jfs_lazycommit jfs 19 syz, C 6 1338d 1480d 0/1 upstream: reported C repro on 2022/10/11 20:09
linux-6.6 KASAN: slab-use-after-free Read in jfs_lazycommit origin:upstream 19 syz, C 153 7d23h 500d 0/2 upstream: reported C repro on 2025/06/18 00:01
▶ ▼ Last patch testing requests (11)
Created Duration User Patch Repo Result
2026/05/06 11:50 39m tristmd@gmail.com patch upstream error
2026/05/05 12:34 27m tristmd@gmail.com patch upstream report log
2026/05/04 22:42 22m tristmd@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2026/04/30 23:13 21m tristmd@gmail.com patch upstream report log
2024/10/13 03:30 1h14m qianqiang.liu@163.com patch upstream OK log
2024/01/08 22:50 35m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2024/01/08 22:50 25m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2024/01/08 21:54 32m retest repro upstream no crash log
2024/01/08 21:54 19m retest repro upstream no crash log
2023/10/01 14:38 14m retest repro upstream report log
2023/10/01 14:38 22m retest repro upstream report log
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/04/03 16:43 56m bisect fix upstream OK (0) job log log

Sample crash report:
blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map
==================================================================
BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
Read of size 4 at addr ffff88807a425894 by task jfsCommit/119

CPU: 1 UID: 0 PID: 119 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5866:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452
 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634
 vfs_get_tree+0x92/0x320 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount fs/namespace.c:3841 [inline]
 path_mount+0x7d0/0x23d0 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount fs/namespace.c:4367 [inline]
 __x64_sys_mount+0x293/0x310 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5761:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6720
 generic_shutdown_super+0x167/0x360 fs/super.c:647
 kill_block_super+0x3b/0xa0 fs/super.c:1665
 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477
 deactivate_super fs/super.c:510 [inline]
 deactivate_super+0xe7/0x110 fs/super.c:506
 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88807a425800
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 148 bytes inside of
 freed 256-byte region [ffff88807a425800, ffff88807a425900)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a424
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5761, tgid 5761 (syz-executor), ts 123295058693, free_ts 123178910398
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab mm/slub.c:3408 [inline]
 new_slab+0xa2/0x650 mm/slub.c:3454
 refill_objects+0xe3/0x410 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5511
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 ____ip_mc_inc_group+0x40b/0x10d0 net/ipv4/igmp.c:1563
 __ip_mc_inc_group net/ipv4/igmp.c:1601 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1607 [inline]
 ip_mc_up+0x154/0x390 net/ipv4/igmp.c:1912
 inetdev_event+0x6c3/0x17f0 net/ipv4/devinet.c:1630
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2250
 call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
 call_netdevice_notifiers net/core/dev.c:2302 [inline]
 __dev_notify_flags+0x12c/0x2e0 net/core/dev.c:9793
 netif_change_flags+0x108/0x160 net/core/dev.c:9822
 do_setlink.isra.0+0x1ac4/0x3e60 net/core/rtnetlink.c:3215
 rtnl_changelink net/core/rtnetlink.c:3849 [inline]
 __rtnl_newlink net/core/rtnetlink.c:4022 [inline]
 rtnl_newlink+0x11c2/0x2380 net/core/rtnetlink.c:4159
page last free pid 64 tgid 64 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 __kmalloc_cache_noprof+0x265/0x6c0 mm/slub.c:5511
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 mca_alloc net/ipv6/mcast.c:871 [inline]
 __ipv6_dev_mc_inc+0x2f1/0xbd0 net/ipv6/mcast.c:961
 addrconf_join_solict net/ipv6/addrconf.c:2262 [inline]
 addrconf_dad_begin net/ipv6/addrconf.c:4134 [inline]
 addrconf_dad_work+0x276/0x1360 net/ipv6/addrconf.c:4262
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88807a425780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807a425800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807a425880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88807a425900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807a425980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

==================================================================
BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
Read of size 4 at addr ffff88802a3bc294 by task jfsCommit/119

CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G    B               syzkaller #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5883:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452
 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634
 vfs_get_tree+0x92/0x320 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount fs/namespace.c:3841 [inline]
 path_mount+0x7d0/0x23d0 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount fs/namespace.c:4367 [inline]
 __x64_sys_mount+0x293/0x310 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5761:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6720
 generic_shutdown_super+0x167/0x360 fs/super.c:647
 kill_block_super+0x3b/0xa0 fs/super.c:1665
 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477
 deactivate_super fs/super.c:510 [inline]
 deactivate_super+0xe7/0x110 fs/super.c:506
 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802a3bc200
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 148 bytes inside of
 freed 256-byte region [ffff88802a3bc200, ffff88802a3bc300)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a3bc800 pfn:0x2a3bc
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910
raw: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88813fe1fb40 ffffea0001de6490 ffffea000074b910
head: ffff88802a3bc800 000000080010000f 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12389696697, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab mm/slub.c:3408 [inline]
 new_slab+0xa2/0x650 mm/slub.c:3454
 refill_objects+0xe3/0x410 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5511
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 usb_string+0x10f/0x570 drivers/usb/core/message.c:1038
 usb_cache_string+0x7c/0x100 drivers/usb/core/message.c:1090
 usb_enumerate_device drivers/usb/core/hub.c:2540 [inline]
 usb_new_device+0x239/0x7d0 drivers/usb/core/hub.c:2665
 register_root_hub+0x4e6/0x639 drivers/usb/core/hcd.c:990
 usb_add_hcd.cold+0xccd/0x1158 drivers/usb/core/hcd.c:2987
 dummy_hcd_probe+0x189/0x2fa drivers/usb/gadget/udc/dummy_hcd.c:2708
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802a3bc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802a3bc200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802a3bc280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88802a3bc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802a3bc380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002c, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

blkno = 5002d, nblocks = 1
ERROR: (device loop0): dbUpdatePMap.cold: blocks are outside the map

==================================================================
BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
Read of size 4 at addr ffff8880319bac94 by task jfsCommit/119

CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Tainted: G    B               syzkaller #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 jfs_lazycommit+0x9a8/0xab0 fs/jfs/jfs_txnmgr.c:2738
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5890:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 jfs_fill_super+0xca/0xf70 fs/jfs/super.c:452
 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634
 vfs_get_tree+0x92/0x320 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount fs/namespace.c:3841 [inline]
 path_mount+0x7d0/0x23d0 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount fs/namespace.c:4367 [inline]
 __x64_sys_mount+0x293/0x310 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5761:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6720
 generic_shutdown_super+0x167/0x360 fs/super.c:647
 kill_block_super+0x3b/0xa0 fs/super.c:1665
 deactivate_locked_super+0xc1/0x1b0 fs/super.c:477
 deactivate_super fs/super.c:510 [inline]
 deactivate_super+0xe7/0x110 fs/super.c:506
 cleanup_mnt+0x21f/0x450 fs/namespace.c:1317
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880319bac00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 148 bytes inside of
 freed 256-byte region [ffff8880319bac00, ffff8880319bad00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x319ba
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe1fb40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22136679680, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab mm/slub.c:3408 [inline]
 new_slab+0xa2/0x650 mm/slub.c:3454
 refill_objects+0xe3/0x410 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kvmalloc_node_noprof+0x793/0x970 mm/slub.c:6933
 v4l2_ctrl_new+0x4a6/0x23a0 drivers/media/v4l2-core/v4l2-ctrls-core.c:2152
 v4l2_ctrl_new_std+0x1bb/0x290 drivers/media/v4l2-core/v4l2-ctrls-core.c:2306
 handler_new_ref+0x82f/0xc60 drivers/media/v4l2-core/v4l2-ctrls-core.c:1887
 v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2456 [inline]
 v4l2_ctrl_add_handler+0x223/0x300 drivers/media/v4l2-core/v4l2-ctrls-core.c:2430
 vivid_create_controls+0x351e/0x3e80 drivers/media/test-drivers/vivid/vivid-ctrls.c:2085
 vivid_create_instance drivers/media/test-drivers/vivid/vivid-core.c:1933 [inline]
 vivid_probe.cold+0x4f1e/0x921e drivers/media/test-drivers/vivid/vivid-core.c:2095
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880319bab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880319bac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880319bac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8880319bad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880319bad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (4332):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/15 19:13 upstream 58717b2a1365 209f0369 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/04/09 12:59 upstream 7f87a5ea75f0 38c8e246 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/07 21:29 upstream 4ae12d8bd9a8 5cb44a80 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/07 19:36 upstream 4ae12d8bd9a8 5cb44a80 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/25 22:09 upstream d9d32e5bd5a4 94a9671e .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in jfs_lazycommit
2026/02/22 10:10 upstream fa5c82f4d2bb 6e7b5511 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/02 01:55 upstream b69053dd3ffb d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2025/11/09 06:20 upstream 7bb4d6512545 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2025/10/21 01:57 upstream 211ddde0823f d422939c .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in jfs_lazycommit
2025/09/15 12:52 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 11:12 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 09:43 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 08:16 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 06:51 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/15 05:27 upstream f83ec76bf285 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/08/17 10:56 upstream 99bade344cfa 1804e95e .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in jfs_lazycommit
2025/07/29 13:48 upstream ae388edd4a8f c4a95487 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in jfs_lazycommit
2025/06/09 06:50 upstream 939f15e640f1 4826c28e .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2025/03/27 13:24 upstream 1e1ba8d23dae 20510e88 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2025/01/21 14:27 upstream 95ec54a420b8 6e87cfa2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2024/11/22 06:21 upstream 28eb75e178d3 4b25d554 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2024/11/01 23:29 upstream 6c52d4da1c74 f00eed24 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2024/10/08 23:20 upstream 5b7c893ed5ed 402f1df0 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/31 17:27 upstream ad9a728a3388 afc0c4d4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/02/24 21:29 upstream d082ecbc71e9 d34966d1 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/19 00:11 linux-next 50f68cc7be0a 77d4d919 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2025/09/25 06:12 linux-next b5a4da2c459f 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/06 21:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 97745f52 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2026/02/02 06:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 6b8752f2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/17 17:22 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 22:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 18:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 17:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 13:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 08:45 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 05:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/26 00:00 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2023/11/10 23:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8de1e7afcc1c 45e9b83e .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2023/05/07 17:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 90c93c40 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2026/03/15 01:27 upstream 69237f8c1f69 ee8d34d6 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (corrupt fs)] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2025/12/31 15:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8f0b4cce4481 d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/10/09 13:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 7e2882b3 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/07/26 22:11 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 82af5ea7c611 fb8f743d .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/05/23 19:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e f8cc0c83 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2025/03/16 21:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5618886fdab e2826670 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in jfs_lazycommit
2022/11/11 11:47 upstream 4bbf3422df78 f42ee5d8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in jfs_lazycommit
2022/10/12 05:32 upstream 493ffd6605b2 02b6492e .config console log report syz C [disk image] [vmlinux] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in jfs_lazycommit
2024/04/27 00:13 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in jfs_lazycommit
2022/09/26 22:13 upstream 3800a713b607 10323ddf .config console log report info ci-qemu-upstream KASAN: use-after-free Read in jfs_lazycommit
2026/10/30 13:40 upstream d89e1d186ec9 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/27 20:52 upstream 62c457528529 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/27 15:09 upstream d135ab453a74 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/27 04:18 upstream d135ab453a74 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/26 15:46 upstream 6b4b543fa187 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/25 16:48 upstream 21a7f44fd076 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/25 06:41 upstream 6fba331225f5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/24 20:55 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/24 09:18 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/23 05:46 upstream a1c2b1da93f5 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/22 22:16 upstream 2a08195e4db5 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/21 21:57 upstream a804c5742bff 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/21 01:21 upstream 4cbdd58dfa7a df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/19 10:42 upstream c03c1a14507d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/19 08:55 upstream c03c1a14507d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/17 16:28 upstream 58161ead29e5 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/16 09:40 upstream 045958acaa75 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/15 22:16 upstream 045958acaa75 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/15 03:12 upstream 0fcb05b72344 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/14 16:47 upstream 4056b3c9d3c9 1a71827b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/13 22:50 upstream 24a19b953e2a 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/12 13:37 upstream 24a19b953e2a 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/11 18:56 upstream b88c841d1164 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/11 02:54 upstream a5ebb76233b7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/10 15:02 upstream 3857c2fe5449 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/09 20:58 upstream af32da41b032 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/09 04:19 upstream 6c377d19d4a5 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/08 10:18 upstream 7b63ef2d55f2 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in jfs_lazycommit
2026/10/07 23:45 upstream 7b63ef2d55f2 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/07 16:04 upstream 602042bf29f6 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/06 11:13 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/06 05:39 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/05 18:04 upstream 67f0943b394d af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/04 07:35 upstream a74306e2e676 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/02 14:34 upstream ce1e0223d8ad 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/01 14:16 upstream 551c722f4080 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/01 12:46 upstream 551c722f4080 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/09/29 22:36 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in jfs_lazycommit
2026/09/29 19:59 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in jfs_lazycommit
2024/06/26 07:07 upstream 55027e689933 dec8bc94 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/24 23:07 upstream 626737a5791b 215eef4a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/20 03:37 upstream c03c1a14507d 21286ae2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/19 17:14 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in jfs_lazycommit
2024/06/25 07:51 upstream 55027e689933 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/28 07:05 linux-next 151a134a4e6e 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/25 01:11 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/22 15:08 linux-next bd1ecbb61afe 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/19 02:47 linux-next 2efb7a11f1aa 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/05 20:42 linux-next bf1ee2bd5c2d 1995e6c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/04 01:27 linux-next f0406245cb98 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2026/10/01 03:53 linux-next 6c2cb8b8b843 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in jfs_lazycommit
2024/05/13 05:16 linux-next 75fa778d74b7 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KFENCE: use-after-free in jfs_lazycommit
2026/02/09 02:19 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in jfs_lazycommit
2026/01/19 20:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in jfs_lazycommit
* Struck through repros no longer work on HEAD.