[BUG] jfs: kernel BUG in txAbort at fs/jfs/jfs_txnmgr.c

[CJ <firefly0158@163.com>]

Hi,


I am reporting a kernel BUG in the JFS transaction abort path, triggered by a
syzkaller reproducer that mounts a crafted JFS image.  The issue is reproducible
with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux
7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and
performs operations that make JFS abort a transaction.  Before the abort, the
filesystem reports that txAbort's entry lookup was called with index 0 and that
a read_mapping_page call failed, so the abort is running on an already-failing
path.


The console shows "kernel BUG at fs/jfs/jfs_txnmgr.c:2798!" with the
Internal error: Oops - BUG class and RIP in txAbort.  The assertion at that site
is assert(mp->nohomeok), so the transaction block is expected to still be pinned
when the abort runs.


One possible cause is that the page-read failure path taken before the abort
releases the transaction block's pin and then still calls txAbort, so the
pinning invariant no longer holds.  This looks like a reference-counting problem
on an error path in the transaction manager.  I am reporting the assertion and
the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
dccc2d773ba9904db8ea.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/dKkQQTF0

console output: https://pastebin.com/raw/7jhmRq91

kernel config: https://pastebin.com/raw/q3YiemVh


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian