[BUG] jfs: kernel BUG in dbFindBits on v7.2-rc3

[CJ]

Hi,


I am reporting that kernel BUG in dbFindBits remains reproducible with a
migrated syzkaller reproducer on Linux 7.2-rc3. The tested HEAD commit is
a13c140cc289c0b7b3770bce5b3ad42ab35074aa.


The reproducer mounts a crafted JFS image and creates a file, causing block
allocation through dbAlloc(), dbAllocAG(), and dbAllocDmapLev().


The allocator reaches dbFindBits() with inconsistent dmap metadata and
triggers a kernel BUG followed by a fatal exception.


This looks like missing validation of corrupted JFS dmap state before the
allocation search reaches an internal invariant in dbFindBits().


This issue was previously reported at:


https://syzkaller.appspot.com/bug?extid=50ede9e39602b45e19f9


Reproducer:


syz reproducer: https://pastebin.com/raw/SPiRnuQU


console output: https://pastebin.com/raw/kiTmEiws
kernel config: https://pastebin.com/raw/S0X5SqR7


Kernel:


HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full)
tested tag: v7.2-rc3


Let me know if you need more details or testing.


Best regards