KASAN: null-ptr-deref Read in txBeginAnon

[Strforexc yn]

Dear Maintainers, When using our customized Syzkaller to fuzz the
latest Linux kernel, the following crash was triggered.

Kernel commit: v6.14-rc4 (Commits on Feb 24, 2025)
Kernel Config : https://github.com/Strforexc/LinuxKernelbug/blob/main/.config
Kernel Log: attachment
reproducer: attachment

Dear Linux Kernel Developers,
I’ve identified a KASAN-reported null-pointer dereference in the JFS
filesystem on kernel 6.14.0-rc4, accompanied by warnings suggesting a
potential remount race. Here are the details:

KASAN reports a null-pointer dereference in txBeginAnon
(fs/jfs/jfs_txnmgr.c:465) while reading 8 bytes at 0x0000000000000040.
The fault occurs during a bit test (_test_bit) via
instrument_atomic_read.
Triggered by a pwritev2 syscall on a JFS volume.
Prior to the crash, the kernel logs: jfs_dirty_inode called on
read-only volume with Is remount racy?, indicating attempts to modify
a read-only filesystem.

Observed during Syzkaller execution on a JFS volume (loop0). Likely
involves a write (pwritev2) racing with a remount to read-only. I
don’t have an exact reproducer but can assist with testing.
Could JFS maintainers investigate this? It seems like a
synchronization issue between remount operations and the transaction
manager. Possible fixes might involve:
1.Adding a read-only check in txBeginAnon before accessing JFS_SBI(sb)->log.
2.Ensuring remount properly synchronizes with in-flight writes.

If you fix this issue, please add the following tag to the commit:
Reported-by: Zhizhuo Tang <strforexctzzchange@xxxxxxxxxxx>, Jianzhou
Zhao <xnxc22xnxc22@xxxxxx>, Haoran Liu <cherest_san@xxxxxxx>

jfs_dirty_inode called on read-only volume
Is remount racy?
jfs_dirty_inode called on read-only volume
Is remount racy?
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read
include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit
include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in txBeginAnon+0x102/0x3e0 fs/jfs/jfs_txnmgr.c:465
Read of size 8 at addr 0000000000000040 by task syz.2.12/11513

CPU: 0 UID: 0 PID: 11513 Comm: syz.2.12 Not tainted 6.14.0-rc4 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
 kasan_report+0xbd/0x100 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x108/0x1e0 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 txBeginAnon+0x102/0x3e0 fs/jfs/jfs_txnmgr.c:465
 extAlloc+0xd4/0x8e0 fs/jfs/jfs_extent.c:78
 jfs_get_block+0x674/0xaa0 fs/jfs/inode.c:248
 __block_write_begin_int+0x4e1/0xd90 fs/buffer.c:2116
 block_write_begin+0x9a/0x1e0 fs/buffer.c:2226
 jfs_write_begin+0x31/0xe0 fs/jfs/inode.c:299
 generic_perform_write+0x2c0/0x910 mm/filemap.c:4189
 __generic_file_write_iter+0x1fe/0x240 mm/filemap.c:4290
 generic_file_write_iter+0xe9/0x3c0 mm/filemap.c:4316
 do_iter_readv_writev+0x63e/0x940 fs/read_write.c:820
 vfs_writev+0x323/0xbf0 fs/read_write.c:1050
 do_pwritev+0x1c1/0x280 fs/read_write.c:1146
 __do_sys_pwritev2 fs/read_write.c:1204 [inline]
 __se_sys_pwritev2 fs/read_write.c:1195 [inline]
 __x64_sys_pwritev2+0xef/0x160 fs/read_write.c:1195
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcb/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff0589b85ad
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff05988af98 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007ff058c45fa0 RCX: 00007ff0589b85ad
RDX: 0000000000000001 RSI: 0000400000000300 RDI: 0000000000000006
RBP: 00007ff058a6a8d6 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff058c45fa0 R15: 00007ff05986b000
 </TASK>
==================================================================
Thanks,
Zhizhuo Tang

Attachment: mount_0.gz
Description: GNU Zip compressed data

Attachment: repro.cprog
Description: Binary data

Attachment: repro.prog
Description: Binary data

Attachment: log0
Description: Binary data