[v6.6] kernel BUG in txAbort

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15c08062580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=d1e49beb0590f426750b
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44e2224124c3/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/33e0aef7ff42/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0515bc436228/bzImage-bb9c90ab.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d1e49b...@syzkaller.appspotmail.com

ERROR: (device loop4): diWrite: ixpxd invalid
BUG at fs/jfs/jfs_txnmgr.c:2795 assert(mp->nohomeok)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_txnmgr.c:2795!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 22078 Comm: syz.4.4061 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:LogSyncRelease fs/jfs/jfs_txnmgr.c:2795 [inline]
RIP: 0010:txAbort+0x59a/0x5d0 fs/jfs/jfs_txnmgr.c:2621
Code: fe e9 3e ff ff ff e8 65 a8 84 fe 48 c7 c7 c0 0b e4 8a 48 c7 c6 b9 07 e4 8a ba eb 0a 00 00 48 c7 c1 a0 1f e4 8a e8 66 18 61 07 <0f> 0b e8 3f a8 84 fe 48 c7 c7 c0 0b e4 8a 48 c7 c6 b9 07 e4 8a ba
RSP: 0018:ffffc9000b51f918 EFLAGS: 00010246
RAX: 0000000000000034 RBX: 0000000000000004 RCX: 45ffd45daba6c800
RDX: ffffc9001281a000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: 0000000000000000 R08: ffffc9000b51f627 R09: 1ffff920016a3ec4
R10: dffffc0000000000 R11: fffff520016a3ec5 R12: 0000000000000024
R13: ffff88802fea49b0 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007f1332c3d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bf9db7dac CR3: 0000000069ed3000 CR4: 00000000003506f0
Call Trace:
<TASK>
txCommit+0x4543/0x5250 fs/jfs/jfs_txnmgr.c:1354
jfs_symlink+0xbd4/0xe50 fs/jfs/namei.c:1039
vfs_symlink+0x138/0x2b0 fs/namei.c:4473
do_symlinkat+0x1b2/0x3f0 fs/namei.c:4499
__do_sys_symlink fs/namei.c:4520 [inline]
__se_sys_symlink fs/namei.c:4518 [inline]
__x64_sys_symlink+0x7e/0x90 fs/namei.c:4518
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1331d8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1332c3d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 00007f1331fb6180 RCX: 00007f1331d8ebe9
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 00002000000204c0
RBP: 00007f1331e11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1331fb6218 R14: 00007f1331fb6180 R15: 00007ffd363381e8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:LogSyncRelease fs/jfs/jfs_txnmgr.c:2795 [inline]
RIP: 0010:txAbort+0x59a/0x5d0 fs/jfs/jfs_txnmgr.c:2621
Code: fe e9 3e ff ff ff e8 65 a8 84 fe 48 c7 c7 c0 0b e4 8a 48 c7 c6 b9 07 e4 8a ba eb 0a 00 00 48 c7 c1 a0 1f e4 8a e8 66 18 61 07 <0f> 0b e8 3f a8 84 fe 48 c7 c7 c0 0b e4 8a 48 c7 c6 b9 07 e4 8a ba
RSP: 0018:ffffc9000b51f918 EFLAGS: 00010246

RAX: 0000000000000034 RBX: 0000000000000004 RCX: 45ffd45daba6c800
RDX: ffffc9001281a000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: 0000000000000000 R08: ffffc9000b51f627 R09: 1ffff920016a3ec4
R10: dffffc0000000000 R11: fffff520016a3ec5 R12: 0000000000000024
R13: ffff88802fea49b0 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007f1332c3d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bfa973990 CR3: 0000000069ed3000 CR4: 00000000003506f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 60a9e718726f Linux 6.6.106
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16473b12580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=d1e49beb0590f426750b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=159b6762580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=156dbb62580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eca27e056a5a/disk-60a9e718.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc64d4eeb7f6/vmlinux-60a9e718.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a345041561ac/bzImage-60a9e718.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c6a3883ab95c/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=116dbb62580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d1e49b...@syzkaller.appspotmail.com

ERROR: (device loop0): diWrite: ixpxd invalid

BUG at fs/jfs/jfs_txnmgr.c:2795 assert(mp->nohomeok)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_txnmgr.c:2795!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN

CPU: 0 PID: 5990 Comm: syz.0.21 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:LogSyncRelease fs/jfs/jfs_txnmgr.c:2795 [inline]
RIP: 0010:txAbort+0x59a/0x5d0 fs/jfs/jfs_txnmgr.c:2621

Code: fe e9 3e ff ff ff e8 f5 60 84 fe 48 c7 c7 00 16 e4 8a 48 c7 c6 f9 11 e4 8a ba eb 0a 00 00 48 c7 c1 e0 29 e4 8a e8 d6 9b 61 07 <0f> 0b e8 cf 60 84 fe 48 c7 c7 00 16 e4 8a 48 c7 c6 f9 11 e4 8a ba
RSP: 0018:ffffc900035c7958 EFLAGS: 00010246
RAX: 0000000000000034 RBX: 0000000000000003 RCX: dbfb246968b87300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffc900035c7667 R09: 1ffff920006b8ecc
R10: dffffc0000000000 R11: fffff520006b8ecd R12: 000000000000001b
R13: ffff88807f0300f8 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007fdcf45fe6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055bf886d4950 CR3: 00000000728b1000 CR4: 00000000003506f0

Call Trace:
<TASK>
txCommit+0x4543/0x5250 fs/jfs/jfs_txnmgr.c:1354

jfs_mkdir+0x833/0xa30 fs/jfs/namei.c:290
vfs_mkdir+0x296/0x440 fs/namei.c:4113
do_mkdirat+0x1d4/0x440 fs/namei.c:4136
__do_sys_mkdirat fs/namei.c:4151 [inline]
__se_sys_mkdirat fs/namei.c:4149 [inline]
__x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4149

do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7fdcf4f8d417
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdcf45fde68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fdcf45fdef0 RCX: 00007fdcf4f8d417
RDX: 00000000000001ff RSI: 0000200000000240 RDI: 00000000ffffff9c
RBP: 0000200000000200 R08: 00002000000000c0 R09: 0000000000000000
R10: 0000200000000200 R11: 0000000000000246 R12: 0000200000000240
R13: 00007fdcf45fdeb0 R14: 0000000000000000 R15: 0000000000000000

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:LogSyncRelease fs/jfs/jfs_txnmgr.c:2795 [inline]
RIP: 0010:txAbort+0x59a/0x5d0 fs/jfs/jfs_txnmgr.c:2621

Code: fe e9 3e ff ff ff e8 f5 60 84 fe 48 c7 c7 00 16 e4 8a 48 c7 c6 f9 11 e4 8a ba eb 0a 00 00 48 c7 c1 e0 29 e4 8a e8 d6 9b 61 07 <0f> 0b e8 cf 60 84 fe 48 c7 c7 00 16 e4 8a 48 c7 c6 f9 11 e4 8a ba
RSP: 0018:ffffc900035c7958 EFLAGS: 00010246
RAX: 0000000000000034 RBX: 0000000000000003 RCX: dbfb246968b87300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffc900035c7667 R09: 1ffff920006b8ecc
R10: dffffc0000000000 R11: fffff520006b8ecd R12: 000000000000001b
R13: ffff88807f0300f8 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007fdcf45fe6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055bf886d4950 CR3: 00000000728b1000 CR4: 00000000003506f0


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.