[moderation] [jfs?] BUG: corrupted list in dbUpdatePMap (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4cbfe4502e3d Merge tag 'v7.1-rc5-ksmbd-server-fixes' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12a6947e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6200d9adbee6a664
dashboard link: https://syzkaller.appspot.com/bug?extid=d4bbc9b5100b35352479
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
CC: [jfs-dis...@lists.sourceforge.net linux-...@vger.kernel.org sha...@kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/55c31ca7a711/disk-4cbfe450.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0be83f2f51bf/vmlinux-4cbfe450.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e5b8feb5e2f3/bzImage-4cbfe450.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d4bbc9...@syzkaller.appspotmail.com

list_add double add: new=ffff88801e3f3628, prev=ffffc900031294c0, next=ffff88801e3f3628.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 129 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 42 23 75 06 cc 48 c7 c7 c0 5c a7 8b 4c 89 fe 4c 89 f2 48 89 d9 e8 8c 2c 7b fc 90 <0f> 0b 48 c7 c7 a0 5a a7 8b e8 7d 2c 7b fc 90 0f 0b 48 c7 c7 60 5b
RSP: 0018:ffffc900038e7ac0 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffff88801e3f3628 RCX: 5d4f767d1e566300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff11003c7e6c6 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff5200071cf09 R12: 1ffff92000625298
R13: dffffc0000000000 R14: ffffc900031294c0 R15: ffff88801e3f3628
FS: 0000000000000000(0000) GS:ffff888126270000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1859854758 CR3: 0000000033960000 CR4: 00000000003526f0
Call Trace:
<TASK>
__list_add_valid include/linux/list.h:96 [inline]
__list_add include/linux/list.h:158 [inline]
list_add include/linux/list.h:177 [inline]
dbUpdatePMap+0x7e4/0xeb0 fs/jfs/jfs_dmap.c:664
txAllocPMap+0x57d/0x6b0 fs/jfs/jfs_txnmgr.c:2427
txUpdateMap+0x81e/0x9c0 fs/jfs/jfs_txnmgr.c:2365
txLazyCommit fs/jfs/jfs_txnmgr.c:2666 [inline]
jfs_lazycommit+0x3ef/0xa10 fs/jfs/jfs_txnmgr.c:2735
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 42 23 75 06 cc 48 c7 c7 c0 5c a7 8b 4c 89 fe 4c 89 f2 48 89 d9 e8 8c 2c 7b fc 90 <0f> 0b 48 c7 c7 a0 5a a7 8b e8 7d 2c 7b fc 90 0f 0b 48 c7 c7 60 5b
RSP: 0018:ffffc900038e7ac0 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffff88801e3f3628 RCX: 5d4f767d1e566300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff11003c7e6c6 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff5200071cf09 R12: 1ffff92000625298
R13: dffffc0000000000 R14: ffffc900031294c0 R15: ffff88801e3f3628
FS: 0000000000000000(0000) GS:ffff888126270000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1859854758 CR3: 0000000033960000 CR4: 00000000003526f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup