[BUG] jfs: WARNING in dbAdjTree from dbJoin

[CJ <firefly0158@163.com>]

Hi,


I am reporting that WARNING in dbJoin appears to remain reproducible with a
migrated syzkaller reproducer on Linux 7.2-rc3. The tested HEAD commit is
a13c140cc289c0b7b3770bce5b3ad42ab35074aa.


The reproducer mounts a crafted JFS image and frees blocks while truncating
and evicting an inode through the lazy-commit path.


dbJoin() calls dbAdjTree() with inconsistent dmap tree state, triggering the
same warning path represented in the source and target reports.


This looks like malformed buddy-tree metadata is not rejected before
dbJoin() attempts to merge and adjust the dmap tree.


This issue was previously reported at:


https://syzkaller.appspot.com/bug?extid=6ca45cc69eba4e310924


Reproducer:


syz reproducer: https://pastebin.com/raw/YPkqGBLU


console output: https://pastebin.com/raw/n6DzxT54
kernel config: https://pastebin.com/raw/eg9SAb9q


Kernel:


HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full)
tested tag: v7.2-rc3


Let me know if you need more details or testing.


Best regards