jfs: fix uninitialized waitqueue in transaction manager

The transaction manager initialization in txInit() was not properly
initializing TxBlock[0].waitor waitqueue, causing a crash when
txEnd(0) is called on read-only filesystems.

When a filesystem is mounted read-only, txBegin() returns tid=0 to
indicate no transaction. However, txEnd(0) still gets called and
tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
waitqueue was never initialized because the initialization loop
started at index 1 instead of 0.

This causes a 'non-static key' lockdep warning and system crash:
  INFO: trying to register non-static key in txEnd

Fix by ensuring all transaction blocks including TxBlock[0] have
their waitqueues properly initialized during txInit().

Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index be17e3c43582f0ec17e1830b1b22b563cafbb0ba..7840a03e5bcb760b127faba3868d31b67091119c 100644 (file)
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -272,14 +272,15 @@ int txInit(void)
        if (TxBlock == NULL)
                return -ENOMEM;
 
-       for (k = 1; k < nTxBlock - 1; k++) {
-               TxBlock[k].next = k + 1;
+       for (k = 0; k < nTxBlock; k++) {
                init_waitqueue_head(&TxBlock[k].gcwait);
                init_waitqueue_head(&TxBlock[k].waitor);
        }
+
+       for (k = 1; k < nTxBlock - 1; k++) {
+               TxBlock[k].next = k + 1;
+       }
        TxBlock[k].next = 0;
-       init_waitqueue_head(&TxBlock[k].gcwait);
-       init_waitqueue_head(&TxBlock[k].waitor);
 
        TxAnchor.freetid = 1;
        init_waitqueue_head(&TxAnchor.freewait);