linux-kernel - Forwarded: Re: [syzbot] [jfs?] BUG: corrupted list in dbUpdatePMap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <690dd257.a70a0220.22f260.003c.GAE@google.com>
Date: Fri, 07 Nov 2025 03:04:55 -0800
From: syzbot <syzbot+4d0a0feb49c5138cac46@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: Re: [syzbot] [jfs?] BUG: corrupted list in dbUpdatePMap

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Re: [syzbot] [jfs?] BUG: corrupted list in dbUpdatePMap
Author: yun.zhou@...driver.com

#syz test

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 871cf4fb3636..0d6c40e7e551 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -270,6 +270,7 @@ static inline struct metapage *alloc_metapage(gfp_t
gfp_mask)
                  mp->clsn = 0;
                  mp->log = NULL;
                  init_waitqueue_head(&mp->wait);
+               INIT_LIST_HEAD(&mp->synclist);
          }
          return mp;
   }
@@ -379,7 +380,7 @@ static void remove_from_logsync(struct metapage *mp)
                  mp->lsn = 0;
                  mp->clsn = 0;
                  log->count--;
-               list_del(&mp->synclist);
+               list_del_init(&mp->synclist);
          }
          LOGSYNC_UNLOCK(log, flags);
   }
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 7840a03e5bcb..a5a5bc0a266d 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -275,6 +275,7 @@ int txInit(void)
          for (k = 0; k < nTxBlock; k++) {
                  init_waitqueue_head(&TxBlock[k].gcwait);
                  init_waitqueue_head(&TxBlock[k].waitor);
+               INIT_LIST_HEAD(&TxBlock[k].synclist);
          }

          for (k = 1; k < nTxBlock - 1; k++) {
@@ -974,7 +975,7 @@ static void txUnlock(struct tblock * tblk)
          if (tblk->lsn) {
                  LOGSYNC_LOCK(log, flags);
                  log->count--;
-               list_del(&tblk->synclist);
+               list_del_init(&tblk->synclist);
                  LOGSYNC_UNLOCK(log, flags);
          }
   }