[BUG] jfs: kernel BUG in txUnlock at fs/jfs/jfs_txnmgr.c

[CJ <firefly0158@163.com>]

Hi,


I am reporting a kernel BUG in the JFS transaction manager, triggered by a
syzkaller reproducer that mounts a crafted JFS image.  The issue is reproducible
with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux
7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and
performs file operations that force transaction commits on it.  The failing
context is the JFS commit thread jfsCommit, not the syscall task.


The console shows "kernel BUG at fs/jfs/jfs_txnmgr.c:933!" with an
invalid-opcode Oops and RIP in txUnlock.  The assertion at that site is
assert(mp->nohomeok > 0): the unlock path requires the transaction block to
still be pinned by the current task.


One possible cause is that the crafted image drives a commit path that returns
early, so the nohomeok reference on the transaction block is dropped before
txUnlock runs and the counter no longer reflects the block's state.  This looks
like a lifetime/reference-counting problem in the transaction manager rather
than a bounds problem, reached only with inconsistent on-disk metadata.  I am
reporting the assertion and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
3c3866c71da45ef61201.  It remains reproducible on v7.3-rc1.


Reproducer:

syz reproducer: https://pastebin.com/raw/nMHHaQgp

console output: https://pastebin.com/raw/z6Aq4my6

kernel config: https://pastebin.com/raw/wDBHjUBC


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian