[BUG] jfs: kernel BUG in dbFindLeaf at fs/jfs/jfs_dmap.c

[CJ <firefly0158@163.com>]

Hi,


I am reporting a kernel BUG in the JFS dmap leaf search, triggered by a
syzkaller reproducer that mounts a crafted JFS image.  The issue is reproducible
with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux
7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and asks
for free blocks, which makes the allocator search the dmap tree for a leaf.


The console shows "kernel BUG at fs/jfs/jfs_dmap.c:3070!" with an
invalid-opcode Oops and RIP in dbFindLeaf.  The assertion at that site is
assert(n < 4), so the search is expected to stay within the four levels the dmap
tree can have.  The call path is dbFindLeaf -> dbAllocDmapLev -> dbAllocCtl ->
dbAllocAG.


One possible cause is that the tree-depth or level value taken from the crafted
image's dmap control page is used without checking it against the four-level
limit, so the search descends past the end of the tree structure.  This looks
like a missing range check on disk-derived tree metadata.  I am reporting the
assertion and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
f0b9c8f03467ee4e5852.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/7RfzStFm

console output: https://pastebin.com/raw/3KAw633C

kernel config: https://pastebin.com/raw/AvXgpdhz


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian