Re: [syzbot] [jfs?] WARNING in dbJoin

[syzbot <syzbot+a67911c5a11315aa55a8@syzkaller.appspotmail.com>]

syzbot has found a reproducer for the following issue on:

HEAD commit:    8cd8cf7a07e5 Merge tag 'scsi-misc' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=161d7986580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bef29eb7c0231032
dashboard link: https://syzkaller.appspot.com/bug?extid=a67911c5a11315aa55a8
compiler:       Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13d192ae580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13e4ebd2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44ae1033ac25/disk-8cd8cf7a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0313654a1152/vmlinux-8cd8cf7a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d7e766b746c/bzImage-8cd8cf7a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/67fe0f2cf90c/mount_0.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15d192ae580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a67911c5a11315aa55a8@syzkaller.appspotmail.com

------------[ cut here ]------------
lp >= size || lp < 0
WARNING: fs/jfs/jfs_dmap.c:2962 at dbAdjTree fs/jfs/jfs_dmap.c:2962 [inline], CPU#1: jfsCommit/116
WARNING: fs/jfs/jfs_dmap.c:2962 at dbJoin+0xc33/0xd60 fs/jfs/jfs_dmap.c:2930, CPU#1: jfsCommit/116
Modules linked in:
CPU: 1 UID: 0 PID: 116 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:dbAdjTree fs/jfs/jfs_dmap.c:2962 [inline]
RIP: 0010:dbJoin+0xc33/0xd60 fs/jfs/jfs_dmap.c:2930
Code: eb 0c e8 50 6a 61 fe eb 05 e8 49 6a 61 fe 31 c0 48 83 c4 68 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8f 76 ab fd cc e8 2e 6a 61 fe 90 <0f> 0b 90 eb df 44 89 e9 80 e1 07 38 c1 0f 8c 00 f4 ff ff 4c 89 ef
RSP: 0018:ffffc90002d9f5b0 EFLAGS: 00010293
RAX: ffffffff8364ca82 RBX: 0000000000000155 RCX: ffff88801e39be00
RDX: 0000000000000000 RSI: 0000000000000155 RDI: 0000000000020056
RBP: 0000000000000004 R08: ffffea0001d26547 R09: 1ffffd40003a4ca8
R10: dffffc0000000000 R11: fffff940003a4ca9 R12: dffffc0000000000
R13: ffff888074995020 R14: 0000000000020056 R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff888125353000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e6fe142b8 CR3: 000000000e746000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 dbFreeBits+0x4a2/0xd70 fs/jfs/jfs_dmap.c:2427
 dbFreeDmap fs/jfs/jfs_dmap.c:2176 [inline]
 dbFree+0x324/0x650 fs/jfs/jfs_dmap.c:485
 txFreeMap+0x9e6/0xde0 fs/jfs/jfs_txnmgr.c:2517
 xtTruncate+0xd16/0x2eb0 fs/jfs/jfs_xtree.c:2481
 jfs_free_zero_link+0x35b/0x4c0 fs/jfs/namei.c:760
 jfs_evict_inode+0x356/0x430 fs/jfs/inode.c:159
 evict+0x624/0xb50 fs/inode.c:828
 txLazyCommit fs/jfs/jfs_txnmgr.c:2666 [inline]
 jfs_lazycommit+0x44c/0xac0 fs/jfs/jfs_txnmgr.c:2735
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.