Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lbmIODone

From: Edward Adam Davis

Date: Fri Apr 17 2026 - 08:41:34 EST


#syz test: upstream master

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61438..054cc01e4579 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,7 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
submit_bio(bio);
}

- wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
+ wait_event(bp->l_ioevent, (bp->l_flag == lbmDONE));

return 0;
}