syzbot
kernel BUG in lbmIODone (5)
Status:
upstream: reported on 2026/07/16 17:25
Reported-by: syzbot+28402e3dbcc95bd93a75@syzkaller.appspotmail.com
First crash: 48d, last: 5d15h
Sample crash report:
BUG at fs/jfs/jfs_logmgr.c:2298 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2298!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:lbmIODone+0x1634/0x1690 fs/jfs/jfs_logmgr.c:2298
Code: 52 19 32 07 0f 0b e8 eb 84 8e fe 48 c7 c7 20 24 c6 8a 48 c7 c6 20 1f c6 8a ba fa 08 00 00 48 c7 c1 a0 2d c6 8a e8 2c 19 32 07 <0f> 0b e8 c5 84 8e fe 48 c7 c7 20 24 c6 8a 48 c7 c6 20 1f c6 8a ba
RSP: 0000:ffffc900001b7ae8 EFLAGS: 00010046
RAX: 000000000000003f RBX: 0000000000000020 RCX: d7915507d0791800
RDX: 0000000000000100 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffff888147bb4808 R08: ffffc900001b77e7 R09: 1ffff92000036efc
R10: dffffc0000000000 R11: fffff52000036efd R12: ffff888147bb4800
R13: dffffc0000000000 R14: 0000000000000a06 R15: ffff888053cb9278
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bd0a4e000 CR3: 000000002ffeb000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
req_bio_endio block/blk-mq.c:782 [inline]
blk_update_request+0x535/0xdf0 block/blk-mq.c:927
blk_mq_end_request+0x3a/0x70 block/blk-mq.c:1052
blk_complete_reqs block/blk-mq.c:1132 [inline]
blk_done_softirq+0x100/0x150 block/blk-mq.c:1137
handle_softirqs+0x291/0x910 kernel/softirq.c:596
run_ksoftirqd+0xa4/0x100 kernel/softirq.c:968
smpboot_thread_fn+0x667/0xa30 kernel/smpboot.c:164
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:lbmIODone+0x1634/0x1690 fs/jfs/jfs_logmgr.c:2298
Code: 52 19 32 07 0f 0b e8 eb 84 8e fe 48 c7 c7 20 24 c6 8a 48 c7 c6 20 1f c6 8a ba fa 08 00 00 48 c7 c1 a0 2d c6 8a e8 2c 19 32 07 <0f> 0b e8 c5 84 8e fe 48 c7 c7 20 24 c6 8a 48 c7 c6 20 1f c6 8a ba
RSP: 0000:ffffc900001b7ae8 EFLAGS: 00010046
RAX: 000000000000003f RBX: 0000000000000020 RCX: d7915507d0791800
RDX: 0000000000000100 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffff888147bb4808 R08: ffffc900001b77e7 R09: 1ffff92000036efc
R10: dffffc0000000000 R11: fffff52000036efd R12: ffff888147bb4800
R13: dffffc0000000000 R14: 0000000000000a06 R15: ffff888053cb9278
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bd0a4e000 CR3: 000000002ffeb000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
* Struck through repros no longer work on HEAD.