[BUG] jfs: KASAN slab-use-after-free in dtSplitPage

[CJ <firefly0158@163.com>]

Hi,


I am reporting a KASAN slab-use-after-free in the JFS directory B-tree code,
triggered by a syzkaller reproducer that mounts a crafted JFS image.  The issue
is reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935
(v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts a crafted JFS filesystem image on a loop device and
performs operations that force a directory page split.


KASAN reports a slab-use-after-free with a 1-byte write, with the report
attributing the access to dtMoveEntry inlined into dtSplitPage at
fs/jfs/jfs_dtree.c.  The write lands in an object from a slab cache that had
already been freed when the split moved entries between pages.


One possible cause is that dtSplitPage keeps using a directory page buffer after
the split path has released it, so the entry move writes into freed memory.  In
the original report the same access was reported at a smaller offset inside the
same function; the offsets differ because the function is large and the build
differs, but the title, the access type and the inlined caller are identical.
This looks like a page-buffer lifetime problem in the dtree split path rather
than a bounds error.  I am reporting the sanitizer finding and the path as
observed.


This appears to be a recurrence of the syzbot issue whose external id is
63c40a3ef45fce944739, title "KASAN: slab-use-after-free in dtSplitPage".  It
remains reproducible on v7.3-rc1.


Reproducer: 


syz reproducer:https://pastebin.com/raw/Sdk1vY9w

console output: https://pastebin.com/raw/LmDQmmyF

kernel config: https://pastebin.com/raw/QSKSFD7u


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian