[BUG] jfs: KASAN use-after-free in diRead() panics the kernel on mount

[Guikun Yang]

Hi Dave,

Found by syzkaller-style fuzzing of 7.2.0-rc5.  A crafted JFS image
triggers a KASAN slab-use-after-free in diRead(), which panics the
kernel when panic_on_warn is set.  The code is unchanged in current
mainline (checked against 7.3.0-rc7 sources).

The freed object is the dbMap descriptor allocated by dbMount() during
jfs_fill_super().  diRead() later reads it after it has been freed,
from the jfs_lookup() -> jfs_iget() -> diRead() path.

Full KASAN report (7.2.0-rc5, PREEMPT full):

==================================================================
BUG: KASAN: slab-use-after-free in diRead+0xa30/0xc40
Read of size 4 at addr ff11000000144034 by task syz.7.6792/81626

CPU: 0 UID: 0 PID: 81626 Comm: syz.7.6792 Tainted: G             L      7.2.0-rc5 #1 PREEMPT(full)
Call Trace:
 <TASK>
 dump_stack_lvl+0x116/0x1b0
 kasan_report+0xca/0x100
 diRead+0xa30/0xc40
 jfs_iget+0x9b/0x5b0
 jfs_lookup+0x27a/0x340
 path_openat+0x293c/0x3dd0
 do_file_open+0x216/0x470
 __x64_sys_openat+0x13f/0x1f0
 </TASK>

Allocated by task 81617:
 __kasan_kmalloc+0xaa/0xb0
 dbMount+0x4f/0xc10
 jfs_mount+0x28d/0x8b0
 jfs_fill_super+0x891/0x1070
 get_tree_bdev_flags+0x389/0x620

The buggy address belongs to the object at ff11000000144000
 which belongs to the cache kmalloc-2k of size 2048

Kernel panic - not syncing: KASAN: panic_on_warn set ...
==================================================================

(The same report was sent on 2026-10-16 but was rejected by the
mailing list because the list addresses were missing from the To/Cc
headers.  Resending with the correct addressing.)

Thanks,
Guikun Yang