kernel BUG in lbmIODone

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4ba8e26127c3 Linux 4.14.262
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=154438ebb00000
kernel config: https://syzkaller.appspot.com/x/.config?x=51e11aabddb4cf62
dashboard link: https://syzkaller.appspot.com/bug?extid=cb8224131116f1986389
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cb8224...@syzkaller.appspotmail.com

BUG at fs/jfs/jfs_logmgr.c:2326 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2326!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 27953 Comm: loop1 Not tainted 4.14.262-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88809e250000 task.stack: ffff888052e30000
RIP: 0010:lbmIODone.cold+0x24/0x5b fs/jfs/jfs_logmgr.c:2326
RSP: 0000:ffff888052e37b00 EFLAGS: 00010082
RAX: 000000000000003f RBX: ffff88809ccd1100 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff878bbcc0 RDI: ffffed100a5c6f56
RBP: 0000000000000020 R08: 000000000000003f R09: 0000000000000001
R10: 0000000000000000 R11: ffff88809e250000 R12: 0000000000000286
R13: 0000000000000000 R14: ffff88809d036040 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0d7abed000 CR3: 00000000a3215000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bio_endio+0x290/0x690 block/bio.c:1918
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2d0/0xa90 block/blk-core.c:2765
blk_mq_end_request+0x4c/0x1e0 block/blk-mq.c:530
__blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571
blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591
loop_handle_cmd drivers/block/loop.c:1784 [inline]
loop_queue_work+0x228/0x21e0 drivers/block/loop.c:1793
kthread_worker_fn+0x271/0x6c0 kernel/kthread.c:667
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 77 fa e8 cb ff ff ff e8 48 83 4d fa 48 c7 c1 80 a6 b6 87 ba 16 09 00 00 48 c7 c6 00 a6 b6 87 48 c7 c7 40 a6 b6 87 e8 98 bd fa ff <0f> 0b e8 22 83 4d fa 48 c7 c1 c0 a6 b6 87 ba 17 09 00 00 48 c7
RIP: lbmIODone.cold+0x24/0x5b fs/jfs/jfs_logmgr.c:2326 RSP: ffff888052e37b00
---[ end trace 100f3dcee4f822ed ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 9d5c0b3a8e1a Linux 4.14.295
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17064a70880000
kernel config: https://syzkaller.appspot.com/x/.config?x=746c079015a92425

dashboard link: https://syzkaller.appspot.com/bug?extid=cb8224131116f1986389
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1493519c880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed6fcf5895a2/disk-9d5c0b3a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/341aa3534116/vmlinux-9d5c0b3a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cb8224...@syzkaller.appspotmail.com

batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready

BUG at fs/jfs/jfs_logmgr.c:2326 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2326!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:

CPU: 1 PID: 9650 Comm: loop4 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
task: ffff88809efcc3c0 task.stack: ffff888097638000

RIP: 0010:lbmIODone.cold+0x24/0x5b fs/jfs/jfs_logmgr.c:2326

RSP: 0018:ffff88809763fb00 EFLAGS: 00010082
RAX: 000000000000003f RBX: ffff88808d147b00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff878bc9e0 RDI: ffffed1012ec7f56

RBP: 0000000000000020 R08: 000000000000003f R09: 0000000000000001

R10: 0000000000000000 R11: ffff88809efcc3c0 R12: 0000000000000286
R13: 0000000000000000 R14: ffff8880997a4480 R15: 0000000000000000

FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00005555566ce848 CR3: 00000000b531f000 CR4: 00000000003406e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bio_endio+0x290/0x690 block/bio.c:1918
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2d0/0xa90 block/blk-core.c:2765
blk_mq_end_request+0x4c/0x1e0 block/blk-mq.c:530
__blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571
blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591

loop_handle_cmd drivers/block/loop.c:1789 [inline]
loop_queue_work+0x228/0x21e0 drivers/block/loop.c:1798

kthread_worker_fn+0x271/0x6c0 kernel/kthread.c:667
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Code: 76 fa e8 cb ff ff ff e8 78 30 4d fa 48 c7 c1 00 ba b6 87 ba 16 09 00 00 48 c7 c6 80 b9 b6 87 48 c7 c7 c0 b9 b6 87 e8 de b9 fa ff <0f> 0b e8 52 30 4d fa 48 c7 c1 40 ba b6 87 ba 17 09 00 00 48 c7
RIP: lbmIODone.cold+0x24/0x5b fs/jfs/jfs_logmgr.c:2326 RSP: ffff88809763fb00
---[ end trace ea569e2de01b79a8 ]---