KASAN: slab-use-after-free Write in jbd2_journal_commit_transaction
Hi Kernel Maintainers,
I hit the following KASAN report while testing current upstream kernel:
KASAN: slab-use-after-free in jbd2_journal_commit_transaction
on commit: bbeb83d3182abe0d245318e274e8531e5dd7a948 (Mar 24 2026)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/032c84edf2505f7f74fb5757e1e6cd1d
The same reproducer sometimes also triggers a KASAN slab-out-of-bounds report at the same site, which may indicate the same underlying bug.
I’m happy to test debug patches or provide additional information.
Reported-by Shuangpeng Bai <[email protected]>
[ 80.268862][ T8554] ================================================================== [ 80.269678][ T8554] BUG: KASAN: slab-use-after-free in jbd2_journal_commit_transaction (./include/linux/instrumented.h:97 ./include/asm-generic/bitops/instrumented-atomic.h:42 ./include/linux/jbd2.h:320 fs/jbd2/commit.c:828) [ 80.270623][ T8554] Write of size 8 at addr ffff8881687ee5e8 by task jbd2/loop0-4107/8554 [ 80.271460][ T8554] [ 80.271710][ T8554] CPU: 1 UID: 0 PID: 8554 Comm: jbd2/loop0-4107 Not tainted 7.0.0-rc5-00051-gbbeb83d3182a #35 PR [ 80.271719][ T8554] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 80.271726][ T8554] Call Trace: [ 80.271729][ T8554] <TASK> [ 80.271732][ T8554] dump_stack_lvl (lib/dump_stack.c:122) [ 80.271743][ T8554] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 80.271795][ T8554] kasan_report (mm/kasan/report.c:597) [ 80.271813][ T8554] kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200) [ 80.271821][ T8554] jbd2_journal_commit_transaction (./include/linux/instrumented.h:97 ./include/asm-generic/bitops/instrumented-atomic.h:42 ./include/linux/jbd2.h:320 fs/jbd2/commit.c:828) [ 80.271912][ T8554] kjournald2 (fs/jbd2/journal.c:202) [ 80.271974][ T8554] kthread (kernel/kthread.c:437) [ 80.271986][ T8554] ret_from_fork (arch/x86/kernel/process.c:164) [ 80.272022][ T8554] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) [ 80.272034][ T8554] </TASK> [ 80.272036][ T8554] [ 80.292650][ T8554] Freed by task 8373 on cpu 1 at 42.645081s: [ 80.293268][ T8554] kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) [ 80.293766][ T8554] kasan_save_free_info (mm/kasan/generic.c:587) [ 80.294292][ T8554] __kasan_slab_free (mm/kasan/common.c:287) [ 80.294796][ T8554] kfree (mm/slub.c:6165 mm/slub.c:6483) [ 80.295206][ T8554] tomoyo_realpath_from_path (security/tomoyo/realpath.c:287) [ 80.295789][ T8554] tomoyo_realpath_nofollow (security/tomoyo/realpath.c:304) [ 80.296344][ T8554] tomoyo_find_next_domain (security/tomoyo/domain.c:731) [ 80.296910][ T8554] tomoyo_bprm_check_security (security/tomoyo/tomoyo.c:102) [ 80.297486][ T8554] security_bprm_check (security/security.c:795) [ 80.298020][ T8554] bprm_execve (fs/exec.c:1655 fs/exec.c:1696 fs/exec.c:1748) [ 80.298486][ T8554] do_execveat_common (fs/exec.c:1846) [ 80.299019][ T8554] __x64_sys_execve (fs/exec.c:1930 fs/exec.c:1924 fs/exec.c:1924) [ 80.299510][ T8554] do_syscall_64 (arch/x86/entry/syscall_64.c:?) [ 80.299984][ T8554] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 80.300597][ T8554] [ 80.300847][ T8554] The buggy address belongs to the object at ffff8881687ee000 [ 80.300847][ T8554] which belongs to the cache kmalloc-4k of size 4096 [ 80.302261][ T8554] The buggy address is located 1512 bytes inside of [ 80.302261][ T8554] freed 4096-byte region [ffff8881687ee000, ffff8881687ef000) [ 80.303678][ T8554] [ 80.303930][ T8554] The buggy address belongs to the physical page: [ 80.304590][ T8554] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1687e8 [ 80.305499][ T8554] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.306363][ T8554] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 80.307153][ T8554] page_type: f5(slab) [ 80.307663][ T8554] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 [ 80.308538][ T8554] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 80.309414][ T8554] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 [ 80.310296][ T8554] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 80.311186][ T8554] head: 017ff00000000003 ffffea0005a1fa01 00000000ffffffff 00000000ffffffff [ 80.312076][ T8554] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 80.312957][ T8554] page dumped because: kasan: bad access detected [ 80.313612][ T8554] page_owner tracks the page as allocated [ 80.314196][ T8554] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN6 [ 80.316275][ T8554] post_alloc_hook (./include/linux/page_owner.h:? mm/page_alloc.c:1889) [ 80.316774][ T8554] get_page_from_freelist (mm/page_alloc.c:? mm/page_alloc.c:3962) [ 80.317348][ T8554] __alloc_frozen_pages_noprof (mm/page_alloc.c:5250) [ 80.317952][ T8554] allocate_slab (mm/slub.c:3294 mm/slub.c:3481) [ 80.318430][ T8554] refill_objects (mm/slub.c:7176) [ 80.318935][ T8554] __pcs_replace_empty_main (mm/slub.c:? mm/slub.c:4615) [ 80.319510][ T8554] __kmalloc_noprof (mm/slub.c:4718 mm/slub.c:4851 mm/slub.c:5259 mm/slub.c:5272) [ 80.320017][ T8554] tomoyo_realpath_from_path (security/tomoyo/realpath.c:252) [ 80.320591][ T8554] tomoyo_path_perm (security/tomoyo/file.c:151 security/tomoyo/file.c:827) [ 80.321100][ T8554] security_inode_getattr (security/security.c:1870) [ 80.321648][ T8554] __se_sys_newfstat (fs/stat.c:260 fs/stat.c:281 fs/stat.c:551 fs/stat.c:546) [ 80.322157][ T8554] do_syscall_64 (arch/x86/entry/syscall_64.c:?) [ 80.322632][ T8554] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 80.323246][ T8554] page last free pid 1 tgid 1 stack trace: [ 80.323852][ T8554] __free_frozen_pages (./include/linux/page_owner.h:? mm/page_alloc.c:1433 mm/page_alloc.c:2978) [ 80.324384][ T8554] free_contig_range (mm/page_alloc.c:7373) [ 80.324886][ T8554] destroy_args (mm/debug_vm_pgtable.c:995) [ 80.325363][ T8554] debug_vm_pgtable (mm/debug_vm_pgtable.c:?) [ 80.325870][ T8554] do_one_initcall (init/main.c:?) [ 80.326370][ T8554] do_initcall_level (init/main.c:1443) [ 80.326890][ T8554] do_initcalls (init/main.c:1457) [ 80.327346][ T8554] kernel_init_freeable (init/main.c:1696) [ 80.327888][ T8554] kernel_init (init/main.c:1584) [ 80.328342][ T8554] ret_from_fork (arch/x86/kernel/process.c:164) [ 80.328827][ T8554] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) [ 80.329327][ T8554] [ 80.329577][ T8554] Memory state around the buggy address: [ 80.330154][ T8554] ffff8881687ee480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.330981][ T8554] ffff8881687ee500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.331803][ T8554] >ffff8881687ee580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.332625][ T8554] ^ [ 80.333389][ T8554] ffff8881687ee600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.334209][ T8554] ffff8881687ee680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.335033][ T8554] ==================================================================
Best,
Shuangpeng