================================================================== BUG: KFENCE: use-after-free write in jfs_lazycommit+0x60e/0xa90 fs/jfs/jfs_txnmgr.c:2736 Use-after-free write at 0xffff88823bda6094 (in kfence-#210): jfs_lazycommit+0x60e/0xa90 fs/jfs/jfs_txnmgr.c:2736 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 kfence-#210: 0xffff88823bda6000-0xffff88823bda60df, size=224, cache=kmalloc-256 allocated by task 4829 on cpu 0 at 91.955066s: kfence_alloc include/linux/kfence.h:128 [inline] slab_alloc_node mm/slub.c:3283 [inline] __kmem_cache_alloc_node+0x202/0x270 mm/slub.c:3398 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] jfs_fill_super+0xd8/0xab0 fs/jfs/super.c:495 mount_bdev+0x28a/0x3c0 fs/super.c:1454 legacy_get_tree+0xe6/0x180 fs/fs_context.c:632 vfs_get_tree+0x88/0x270 fs/super.c:1584 do_new_mount+0x247/0xa40 fs/namespace.c:3078 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3606 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 freed by task 4273 on cpu 1 at 93.037750s: generic_shutdown_super+0x130/0x340 fs/super.c:501 kill_block_super+0x7c/0xe0 fs/super.c:1481 deactivate_locked_super+0x93/0xf0 fs/super.c:332 cleanup_mnt+0x471/0x4f0 fs/namespace.c:1191 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 CPU: 1 PID: 109 Comm: jfsCommit Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:jfs_lazycommit+0x60e/0xa90 fs/jfs/jfs_txnmgr.c:2736 Code: fe 41 83 fe 03 7f 63 e8 d0 6b 8d fe 48 c7 c7 00 a7 db 96 e8 d4 da 47 07 48 89 44 24 10 42 0f b6 04 2b 84 c0 0f 85 4f 01 00 00 <41> 80 27 fe 4c 8b 25 07 e0 e6 13 49 81 fc 40 a7 db 96 0f 84 96 02 RSP: 0018:ffffc90002d97de0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 1ffff110477b4c12 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90002d97cc0 RBP: ffffc90002d97f00 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520005b2f98 R12: ffffc900026e9110 R13: dffffc0000000000 R14: 0000000000000002 R15: ffff88823bda6094 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bda6094 CR3: 0000000059e11000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ================================================================== ---------------- Code disassembly (best guess): 0: fe 41 83 incb -0x7d(%rcx) 3: fe 03 incb (%rbx) 5: 7f 63 jg 0x6a 7: e8 d0 6b 8d fe call 0xfe8d6bdc c: 48 c7 c7 00 a7 db 96 mov $0xffffffff96dba700,%rdi 13: e8 d4 da 47 07 call 0x747daec 18: 48 89 44 24 10 mov %rax,0x10(%rsp) 1d: 42 0f b6 04 2b movzbl (%rbx,%r13,1),%eax 22: 84 c0 test %al,%al 24: 0f 85 4f 01 00 00 jne 0x179 * 2a: 41 80 27 fe andb $0xfe,(%r15) <-- trapping instruction 2e: 4c 8b 25 07 e0 e6 13 mov 0x13e6e007(%rip),%r12 # 0x13e6e03c 35: 49 81 fc 40 a7 db 96 cmp $0xffffffff96dba740,%r12 3c: 0f .byte 0xf 3d: 84 .byte 0x84 3e: 96 xchg %eax,%esi 3f: 02 .byte 0x2