WARNING: proc registration bug in jbd2_journal_destroy

Status: moderation: reported on 2026/08/02 13:51
Subsystems: ext4
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+c9c72dac0af06fc4c94e@syzkaller.appspotmail.com
First crash: 6d09h, last: 6d09h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
c10b229f assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ WARNING: proc registration bug in jbd2_journal_destroy 2026/07/31 00:00 2026/07/31 00:00 2026/07/31 00:46 aaffb173 

			
				
	

	
	



			

		

	

	

	
	
Sample crash report:

	
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x319/0xdc0 fs/namespace.c:3841
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb2e419f10a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb2e500ee18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb2e500eea0 RCX: 00007fb2e419f10a
RDX: 0000200000004440 RSI: 0000200000000040 RDI: 00007fb2e500ee60
RBP: 0000200000004440 R08: 00007fb2e500eea0 R09: 00000000000008c0
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fb2e500ee60 R14: 000000000000442a R15: 0000200000000600
 </TASK>
JBD2: Ignoring recovery information on journal
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 1, space 0, times 937
CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x40c/0x560 lib/fault-inject.c:174
 should_failslab+0xa8/0x100 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4539 [inline]
 slab_alloc_node mm/slub.c:4897 [inline]
 kmem_cache_alloc_noprof+0xa6/0x5f0 mm/slub.c:4931
 __kernfs_new_node+0xe6/0x980 fs/kernfs/dir.c:665
 kernfs_new_node fs/kernfs/dir.c:751 [inline]
 kernfs_create_dir_ns+0xfe/0x230 fs/kernfs/dir.c:1120
 sysfs_create_dir_ns+0x12f/0x2a0 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x622/0xcd0 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_init_and_add+0x12b/0x1a0 lib/kobject.c:457
 ocfs2_filecheck_create_sysfs+0x1af/0x290 fs/ocfs2/filecheck.c:184
 ocfs2_fill_super+0x39b6/0x6840 fs/ocfs2/super.c:1105
 get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1640
 vfs_get_tree+0x92/0x2a0 fs/super.c:1700
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x319/0xdc0 fs/namespace.c:3841
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb2e419f10a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb2e500ee18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb2e500eea0 RCX: 00007fb2e419f10a
RDX: 0000200000004440 RSI: 0000200000000040 RDI: 00007fb2e500ee60
RBP: 0000200000004440 R08: 00007fb2e500eea0 R09: 00000000000008c0
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fb2e500ee60 R14: 000000000000442a R15: 0000200000000600
 </TASK>
kobject: kobject_add_internal failed for filecheck (error: -12 parent: loop0)
(syz.0.0,5326,0):ocfs2_fill_super:1108 ERROR: Unable to create filecheck sysfs directory at /sys/fs/ocfs2/loop0/filecheck.
------------[ cut here ]------------
name 'info'
WARNING: fs/proc/generic.c:741 at remove_proc_entry+0x35a/0x690 fs/proc/generic.c:741, CPU#0: syz.0.0/5326
Modules linked in:
CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:remove_proc_entry+0x35f/0x690 fs/proc/generic.c:741
Code: ff e9 14 ff ff ff e8 e0 32 53 ff eb 05 e8 d9 32 53 ff 48 c7 c7 a0 2d d2 8e e8 cd d4 61 09 48 8d 3d 66 6f ea 0d 48 8b 74 24 08 <67> 48 0f b9 3a 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
RSP: 0018:ffffc9000e00ee28 EFLAGS: 00010286
RAX: 0000000080000000 RBX: ffff88803fed8000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8c06b920 RDI: ffffffff905e50f0
RBP: 0000000000000004 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52001c01db4 R12: 0000000000000000
R13: ffffffff8c06b920 R14: ffff88803fed80b0 R15: dffffc0000000000
FS:  00007fb2e500f6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc907c09000 CR3: 0000000012979000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 jbd2_stats_proc_exit fs/jbd2/journal.c:1231 [inline]
 jbd2_journal_destroy+0x64b/0x7f0 fs/jbd2/journal.c:2175
 ocfs2_journal_shutdown+0x515/0xb70 fs/ocfs2/journal.c:1107
 ocfs2_dismount_volume+0x3dc/0x8d0 fs/ocfs2/super.c:1853
 ocfs2_fill_super+0x3f1b/0x6840 fs/ocfs2/super.c:1166
 get_tree_bdev_flags+0x430/0x4f0 fs/super.c:1640
 vfs_get_tree+0x92/0x2a0 fs/super.c:1700
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x319/0xdc0 fs/namespace.c:3841
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4367
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb2e419f10a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb2e500ee18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb2e500eea0 RCX: 00007fb2e419f10a
RDX: 0000200000004440 RSI: 0000200000000040 RDI: 00007fb2e500ee60
RBP: 0000200000004440 R08: 00007fb2e500eea0 R09: 00000000000008c0
R10: 00000000000008c0 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fb2e500ee60 R14: 000000000000442a R15: 0000200000000600
 </TASK>
----------------
Code disassembly (best guess):
   0:	ff                   	ljmp   (bad)
   1:	e9 14 ff ff ff       	jmp    0xffffff1a
   6:	e8 e0 32 53 ff       	call   0xff5332eb
   b:	eb 05                	jmp    0x12
   d:	e8 d9 32 53 ff       	call   0xff5332eb
  12:	48 c7 c7 a0 2d d2 8e 	mov    $0xffffffff8ed22da0,%rdi
  19:	e8 cd d4 61 09       	call   0x961d4eb
  1e:	48 8d 3d 66 6f ea 0d 	lea    0xdea6f66(%rip),%rdi        # 0xdea6f8b
  25:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	48 83 c4 20          	add    $0x20,%rsp
  33:	5b                   	pop    %rbx
  34:	41 5c                	pop    %r12
  36:	41 5d                	pop    %r13
  38:	41 5e                	pop    %r14
  3a:	41 5f                	pop    %r15
  3c:	5d                   	pop    %rbp
  3d:	c3                   	ret
  3e:	cc                   	int3
  3f:	cc                   	int3



	

	



	Crashes (1):
		
		

			Time
			Kernel
			Commit
			Syzkaller
			Config
			Log
			Report
			Syz repro
			C repro
			VM info
			Assets (help?)
			Manager
			Title
		

		
		
		
		

			2026/07/29 13:46
			upstream
			fc02acf6ac0c
			b63596d1
			.config
			console log
			report
			
			
			
			
				[disk image (non-bootable)]
			
				[vmlinux]
			
				[kernel image]
			
			ci-snapshot-upstream-root
			WARNING: proc registration bug in jbd2_journal_destroy
		

		
		


* Struck through repros no longer work on HEAD.