==================================================================
BUG: KASAN: use-after-free in dtMoveEntry fs/jfs/jfs_dtree.c:4232 [inline]
BUG: KASAN: use-after-free in dtSplitPage+0x1a2c/0x3160 fs/jfs/jfs_dtree.c:1561
Write of size 1 at addr ffff888075694000 by task syz.3.40/4497

CPU: 0 PID: 4497 Comm: syz.3.40 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 dtMoveEntry fs/jfs/jfs_dtree.c:4232 [inline]
 dtSplitPage+0x1a2c/0x3160 fs/jfs/jfs_dtree.c:1561
 dtSplitUp fs/jfs/jfs_dtree.c:1092 [inline]
 dtInsert+0x1074/0x57e0 fs/jfs/jfs_dtree.c:871
 jfs_mkdir+0x764/0xb00 fs/jfs/namei.c:270
 vfs_mkdir+0x386/0x570 fs/namei.c:4073
 do_mkdirat+0x1dd/0x5c0 fs/namei.c:4098
 __do_sys_mkdirat fs/namei.c:4113 [inline]
 __se_sys_mkdirat fs/namei.c:4111 [inline]
 __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4111
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff294c1df47
Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff292e76e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007ff292e76ee0 RCX: 00007ff294c1df47
RDX: 00000000000001ff RSI: 0000200000000280 RDI: 00000000ffffff9c
RBP: 00002000000007c0 R08: 0000200000000d40 R09: 0000000000000000
R10: 00002000000007c0 R11: 0000000000000246 R12: 0000200000000280
R13: 00007ff292e76ea0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

The buggy address belongs to the page:
page:ffffea0001d5a500 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x75694
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0000912908 ffffea0001e2d188 0000000000000000
raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 4187, ts 71045581639, free_ts 72703836615
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 __get_free_pages mm/page_alloc.c:5538 [inline]
 get_zeroed_page+0x13/0x30 mm/page_alloc.c:5547
 pud_alloc_one include/asm-generic/pgalloc.h:166 [inline]
 __pud_alloc+0x31/0x140 mm/memory.c:4933
 pud_alloc include/linux/mm.h:2185 [inline]
 copy_pud_range mm/memory.c:1184 [inline]
 copy_p4d_range mm/memory.c:1228 [inline]
 copy_page_range+0x2d19/0x32c0 mm/memory.c:1301
 dup_mmap kernel/fork.c:616 [inline]
 dup_mm kernel/fork.c:1467 [inline]
 copy_mm+0xc61/0x13d0 kernel/fork.c:1519
 copy_process+0x17fb/0x3ec0 kernel/fork.c:2291
 kernel_clone+0x23f/0x990 kernel/fork.c:2681
 __do_sys_clone kernel/fork.c:2798 [inline]
 __se_sys_clone kernel/fork.c:2782 [inline]
 __x64_sys_clone+0x19a/0x210 kernel/fork.c:2782
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page_list+0x119/0x830 mm/page_alloc.c:3433
 release_pages+0x185f/0x1bd0 mm/swap.c:963
 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:241 [inline]
 tlb_flush_mmu mm/mmu_gather.c:248 [inline]
 tlb_finish_mmu+0x1b4/0x370 mm/mmu_gather.c:371
 exit_mmap+0x3d0/0x640 mm/mmap.c:3218
 __mmput+0x115/0x390 kernel/fork.c:1128
 exit_mm+0x632/0x7b0 kernel/exit.c:557
 do_exit+0x5b8/0x2110 kernel/exit.c:877
 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004
 get_signal+0x7eb/0x12e0 kernel/signal.c:2909
 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff888075693f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888075693f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888075694000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888075694080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888075694100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================