[BUG] jfs: KASAN: slab-use-after-free in lmLogSync on Linux 7.2-rc3

[ZW Tang]

Hi,

I am reporting a KASAN slab-use-after-free issue triggered by a
syzkaller reproducer in the JFS filesystem on Linux 7.2-rc3.

Although a similar JFS lazy-commit / unmount use-after-free issue has
been reported before, I can still trigger this crash on Linux 7.2-rc3
with the attached syzkaller reproducer.

The crash is reported in lmLogSync() from the JFS log manager:

BUG: KASAN: slab-use-after-free in lmLogSync+0x7f5/0x840
Write of size 4 at addr ffff888025ecba18 by task jfsCommit/119

CPU: 0 UID: 0 PID: 119 Comm: jfsCommit Not tainted 7.2.0-rc3 #1 PREEMPT(full)

The observed call trace is:

lmLogSync+0x7f5/0x840
jfs_syncpt+0x8d/0xa0
txEnd+0x30a/0x5a0
jfs_lazycommit+0x774/0xb40
kthread+0x404/0x530
ret_from_fork+0x7c5/0xde0
ret_from_fork_asm+0x1a/0x30

KASAN also shows that the affected object was allocated from the JFS mount path:

Allocated by task 10908:
  lmLogOpen+0x576/0x1300
  jfs_mount_rw+0x2ec/0x6d0
  jfs_fill_super+0xd28/0x1080
  get_tree_bdev_flags+0x38a/0x620
  vfs_get_tree+0x97/0x3b0
  fc_mount+0x18/0x110
  path_mount+0x777/0x1e20
  do_mount+0xc5/0x120
  __x64_sys_mount+0x193/0x230

and freed during the JFS unmount / log close path:

Freed by task 9881:
  kfree+0x2ac/0x6d0
  lmLogClose+0x596/0x720
  jfs_umount+0x30b/0x450
  jfs_put_super+0x85/0x1d0
  generic_shutdown_super+0x166/0x400
  kill_block_super+0x3b/0x90
  deactivate_locked_super+0xbb/0x130
  deactivate_super+0xb1/0xd0
  cleanup_mnt+0x378/0x510

This looks like a race in the JFS log / lazy-commit teardown path.
During unmount, jfs_umount() can close and free the JFS log object
through lmLogClose(), while the background jfsCommit thread is still
processing lazy commit work. The lazy commit path later reaches
txEnd() and jfs_syncpt(), which calls lmLogSync() and accesses the
already freed struct jfs_log, triggering the KASAN use-after-free.

Reproducer:

syz reproducer: https://pastebin.com/raw/XP3dARk0
console output: https://pastebin.com/raw/rC9xj4GX
kernel config: https://pastebin.com/raw/fk2bNppW

Kernel:

git tree: torvalds/linux
kernel version: 7.2.0-rc3
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
environment: QEMU Ubuntu 24.10

Best regards