[syzbot] general protection fault in lmLogSync (2)

syzbot

unread,

Sep 29, 2022, 4:40:41 PM9/29/22

to jfs-dis...@lists.sourceforge.net, linux-...@vger.kernel.org, sha...@kernel.org, syzkall...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: c3e0e1e23c70 Merge tag 'irq_urgent_for_v6.0' of git://git...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1599a048880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba0d23aa7e1ffaf5
dashboard link: https://syzkaller.appspot.com/bug?extid=e14b1036481911ae4d77
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13b404c0880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=179f60b8880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e7f1f925f94e/disk-c3e0e1e2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/830dabeedf0d/vmlinux-c3e0e1e2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e14b10...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 3619 Comm: syz-executor117 Not tainted 6.0.0-rc7-syzkaller-00081-gc3e0e1e23c70 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x227/0xb00 fs/jfs/jfs_logmgr.c:937
Code: b2 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 37 66 da fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 1a 66 da fe 48 8b 3b e8 32 89 b2
RSP: 0018:ffffc900039dfae0 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 4daf7eec4cfcb600
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900039dfbe8 R08: ffffffff81b29a43 R09: ffffc900039dfa30
R10: fffff5200073bf49 R11: 1ffff9200073bf46 R12: dffffc0000000000
R13: ffff88807736d800 R14: 0000000000000000 R15: ffff888020ba2638
FS: 00005555574fa300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555557503628 CR3: 0000000021420000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jfs_syncpt+0x79/0x90 fs/jfs/jfs_logmgr.c:1041
jfs_sync_fs+0x86/0xa0 fs/jfs/super.c:685
sync_filesystem+0xe8/0x220 fs/sync.c:56
generic_shutdown_super+0x6b/0x300 fs/super.c:474
kill_block_super+0x79/0xd0 fs/super.c:1427
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x4ce/0x560 fs/namespace.c:1186
task_work_run+0x146/0x1c0 kernel/task_work.c:177
ptrace_notify+0x29a/0x340 kernel/signal.c:2353
ptrace_report_syscall include/linux/ptrace.h:420 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:482 [inline]
syscall_exit_work+0x8c/0xe0 kernel/entry/common.c:249
syscall_exit_to_user_mode_prepare+0x63/0xc0 kernel/entry/common.c:276
__syscall_exit_to_user_mode_work kernel/entry/common.c:281 [inline]
syscall_exit_to_user_mode+0xa/0x60 kernel/entry/common.c:294
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f50d6eec917
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcf5fdfe28 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f50d6eec917
RDX: 00007ffcf5fdfee9 RSI: 000000000000000a RDI: 00007ffcf5fdfee0
RBP: 00007ffcf5fdfee0 R08: 00000000ffffffff R09: 00007ffcf5fdfcc0
R10: 00005555574fb653 R11: 0000000000000206 R12: 00007ffcf5fe0f50
R13: 00005555574fb5f0 R14: 00007ffcf5fdfe50 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x227/0xb00 fs/jfs/jfs_logmgr.c:937
Code: b2 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 37 66 da fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 1a 66 da fe 48 8b 3b e8 32 89 b2
RSP: 0018:ffffc900039dfae0 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 4daf7eec4cfcb600
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900039dfbe8 R08: ffffffff81b29a43 R09: ffffc900039dfa30
R10: fffff5200073bf49 R11: 1ffff9200073bf46 R12: dffffc0000000000
R13: ffff88807736d800 R14: 0000000000000000 R15: ffff888020ba2638
FS: 00005555574fa300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005613768c4db8 CR3: 0000000021420000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: b2 fe mov $0xfe,%dl
2: 49 8d 5f f0 lea -0x10(%r15),%rbx
6: 48 89 d8 mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 37 66 da fe callq 0xfeda6653
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 30 add $0x30,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 1a 66 da fe callq 0xfeda6653
39: 48 8b 3b mov (%rbx),%rdi
3c: e8 .byte 0xe8
3d: 32 .byte 0x32
3e: 89 .byte 0x89
3f: b2 .byte 0xb2

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

syzbot

unread,

Feb 25, 2026, 2:10:39 PM (3 days ago) Feb 25

to linux-...@vger.kernel.org, syzkall...@googlegroups.com

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [syzbot] general protection fault in lmLogSync (2)
Author: ko...@igalia.com

#syz test

Helen Koike

unread,

Feb 27, 2026, 4:14:13 AM (yesterday) Feb 27

to syzkaller-bugs

#syz test

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 5b1c5da04163..1fa202fc0458 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -74,12 +74,6 @@ static struct lbuf *log_redrive_list;
static DEFINE_SPINLOCK(log_redrive_lock);

-/*
- * log read/write serialization (per log)
- */
-#define LOG_LOCK_INIT(log) mutex_init(&(log)->loglock)
-#define LOG_LOCK(log) mutex_lock(&((log)->loglock))
-#define LOG_UNLOCK(log) mutex_unlock(&((log)->loglock))

/*
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 8b8994e48cd0..09e0ef6aecce 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -402,6 +402,13 @@ struct jfs_log {
int no_integrity; /* 3: flag to disable journaling to disk */
};

+/*
+ * log read/write serialization (per log)
+ */
+#define LOG_LOCK_INIT(log) mutex_init(&(log)->loglock)
+#define LOG_LOCK(log) mutex_lock(&((log)->loglock))
+#define LOG_UNLOCK(log) mutex_unlock(&((log)->loglock))

+
/*
* Log flag
*/
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index 8ec43f53f686..8547bb5cd3f4 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -20,6 +20,7 @@
#include "jfs_superblock.h"
#include "jfs_dmap.h"
#include "jfs_imap.h"
+#include "jfs_logmgr.h"
#include "jfs_metapage.h"
#include "jfs_debug.h"

@@ -63,6 +64,12 @@ int jfs_umount(struct super_block *sb)
diUnmount(ipimap, 0);

diFreeSpecial(ipimap);
+ /*
+ * Hold log lock so write_special_inodes (lmLogSync) cannot see
+ * this sbi with a NULL inode pointer while iterating log->sb_list.
+ */
+ if (log)
+ LOG_LOCK(log);
sbi->ipimap = NULL;

/*
@@ -88,6 +95,8 @@ int jfs_umount(struct super_block *sb)

diFreeSpecial(ipbmap);
sbi->ipbmap = NULL;
+ if (log)
+ LOG_UNLOCK(log);
/*

* Make sure all metadata makes it to disk before we mark

syzbot

unread,

Feb 27, 2026, 4:15:04 AM (yesterday) Feb 27

to ko...@igalia.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file fs/jfs/jfs_logmgr.c
patch: **** malformed patch at line 24:

Tested on:

commit: a75cb869 Merge tag 'v7.0-rc1-ksmbd-server-fixes' of gi..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=abe4fa590468dbfb

dashboard link: https://syzkaller.appspot.com/bug?extid=e14b1036481911ae4d77
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=14fea8d6580000

Aleksandr Nogikh

unread,

Feb 27, 2026, 4:19:55 AM (yesterday) Feb 27

to Helen Koike, syzkaller-bugs

Hi Helen,

Just FYI
1) It's best to send patch testing requests directly to syzbot (to
syzbo...@syzkaller.appspotmail.com), otherwise it may have trouble
identifying the specific bug you mean (in this case it managed to,
though).
2) Syzbot also understands email attachments, that way there's the
least chance of patch corruption.

--
Aleksandr

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/079704e1-9af1-42a7-85a3-6b48be909525n%40googlegroups.com.

syzbot

unread,

Feb 27, 2026, 4:19:58 AM (yesterday) Feb 27

to nog...@google.com, ko...@igalia.com, nog...@google.com, syzkall...@googlegroups.com

> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/CANp29Y6VY5e5aUqRkgCXb5Y2hgEMKN1XQu%3DMuNNn6zKZNLKCGQ%40mail.gmail.com.

I see the command but can't find the corresponding bug.
The email is sent to syzbo...@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.

Helen Koike

unread,

Feb 27, 2026, 8:07:26 AM (yesterday) Feb 27

to Aleksandr Nogikh, syzkaller-bugs

On 2/27/26 6:19 AM, Aleksandr Nogikh wrote:
> Hi Helen,
>
> Just FYI
> 1) It's best to send patch testing requests directly to syzbot (to
> syzbo...@syzkaller.appspotmail.com), otherwise it may have trouble
> identifying the specific bug you mean (in this case it managed to,
> though).
> 2) Syzbot also understands email attachments, that way there's the
> least chance of patch corruption.
>

Ack, thanks for the heads up.
This is my first time interacting with syzbot, so I'm still getting the
hang of it.

I re-sent the patch only to syzbot yesterday as attachment and received
the result back.

I'll submit the patch soon.

Regards,
Helen

syzbot

unread,

Feb 27, 2026, 8:07:29 AM (yesterday) Feb 27

to ko...@igalia.com, ko...@igalia.com, nog...@google.com, syzkall...@googlegroups.com

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.

> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/45539ac4-f7e5-4767-8462-d890299fee10%40igalia.com.

syzbot

unread,

Feb 27, 2026, 8:10:48 AM (yesterday) Feb 27

to linux-...@vger.kernel.org, syzkall...@googlegroups.com

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [syzbot] [jfs?] general protection fault in lmLogSync (2)
Author: ko...@igalia.com

#syz test

syzbot

unread,

Feb 27, 2026, 8:38:06 AM (yesterday) Feb 27

to ko...@igalia.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+e14b10...@syzkaller.appspotmail.com
Tested-by: syzbot+e14b10...@syzkaller.appspotmail.com

Tested on:

commit: a75cb869 Merge tag 'v7.0-rc1-ksmbd-server-fixes' of gi..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=16a150ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=70fe0401f305d8d4
dashboard link: https://syzkaller.appspot.com/bug?extid=e14b1036481911ae4d77
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10bcd9ef980000

Note: testing is done by a robot and is best-effort only.

Reply all

Reply to author

Forward