[BUG] jfs: kernel BUG in txEnd at fs/jfs/jfs_txnmgr.c

[CJ]

Hi,


I am reporting a kernel BUG in the JFS transaction manager, triggered by a
syzkaller reproducer that mounts a crafted JFS image.  The issue is reproducible
with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux
7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and then
truncates a file, which makes JFS walk a corrupt extent tree.


The console shows the truncate path reporting a corrupt xtree page and remounting
the filesystem read-only, and then "kernel BUG at fs/jfs/jfs_txnmgr.c:530!" with
an invalid-opcode Oops and RIP in txEnd.  The assertion at that site is
assert(tblk->next == 0), so the transaction block being ended is still linked.


One possible cause is that the error path taken after the corrupt xtree page is
detected ends the transaction twice, or leaves a transaction block linked when
txEnd expects it to be detached, so the linked-list invariant the assertion
checks is violated.  This looks like state management of the transaction block
list on an error path rather than a bounds problem.  I am reporting the
assertion and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
914c3cb75ef219729a2e.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/V4Mc0vrp

console output: https://pastebin.com/raw/8K3r0xpr

kernel config: https://pastebin.com/raw/zRz2p0BE


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian