From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C1AF36C5B0 for ; Mon, 19 Jan 2026 13:54:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768830857; cv=none; b=LUjHRFDm3TsKWwDIgsBBcjhebz0ghumCFoHiYLbDqw2D5a1BZ56zzePGvokiJYWfAFmWDnuDsOa6DvxhjnGCrRXoct2ngqVxDq89eeYzAwa3oK1u6u4YMPcur5OG1NhHcXoVWSnUb8DJ4Lf6JFZ7MhMK0qK/NR2YYpZpNnQZd9g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768830857; c=relaxed/simple; bh=UCcrN4g6ZzXkM+5m+tcl3ItNF1NqqQRbwaKWqRbYiTU=; h=Content-Type:MIME-Version:Subject:From:Message-Id:Date:References: In-Reply-To:To:Cc; b=EcWn/5a2WY5KIlZTIVFqvFJ3Hl/84vO+AsJMJ6ozWFSmYO/2H5awNQmhU1J+Hn1d8EXWCc0+XI7uc8P/lw5PetmYsEBKV2iD7eRwAaUHBmdQQKgWW3L/CRru+y3C/sTO52IaJJ/NKohubZSFUoiN31FF70laSNE0YRwMacGGrI8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HOiIoxtP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HOiIoxtP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5F8CC116C6; Mon, 19 Jan 2026 13:54:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768830856; bh=UCcrN4g6ZzXkM+5m+tcl3ItNF1NqqQRbwaKWqRbYiTU=; h=Subject:From:Date:References:In-Reply-To:To:Cc:From; b=HOiIoxtPlW2BzrowwYkgGoD8a5bqRa3Ypp+vPcZHy3xAtBBZVjlR+bIEsRjGe9Gur ZE2UFjYD8jGRC/PLeczC67h7+u+pkHzNpOPK2N5YobLAc4yscWEN2NyjBcQgyULcUo EKRKaGMoHThjwzlHojVS6xGSsBrUG8+rt0P4iMcBu4yuHb/FoOaO0DsHqkLfWd+9B2 Ic6rZFoUfi1JUYXRyNsnkOauuJimxS4LQe71DpB0HhBHIfPU7OhB7UYTeeXAd0zsE1 vy9VL1dmH+vauUsXvER836BRrkEQkXicLUKeEcGPCRmP+vF9zQVNa3IwM4VQpsuGyy d2wvRTGR84XDA== Received: from [10.30.226.235] (localhost [IPv6:::1]) by aws-us-west-2-korg-oddjob-rhel9-1.codeaurora.org (Postfix) with ESMTP id F28B93A54A38; Mon, 19 Jan 2026 13:50:47 +0000 (UTC) Content-Type: text/plain; charset="utf-8" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [f2fs-dev] [PATCH] f2fs: fix to avoid UAF in f2fs_write_end_io() From: patchwork-bot+f2fs@kernel.org Message-Id: <176883064677.1419958.15115865034651314152.git-patchwork-notify@kernel.org> Date: Mon, 19 Jan 2026 13:50:46 +0000 References: <20260107112218.1789-1-chao@kernel.org> In-Reply-To: <20260107112218.1789-1-chao@kernel.org> To: Chao Yu Cc: jaegeuk@kernel.org, syzbot+b4444e3c972a7a124187@syzkaller.appspotmail.com, stable@kernel.org, linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Hello: This patch was applied to jaegeuk/f2fs.git (dev) by Jaegeuk Kim : On Wed, 7 Jan 2026 19:22:18 +0800 you wrote: > As syzbot reported an use-after-free issue in f2fs_write_end_io(). > > It is caused by below race condition: > > loop device umount > - worker_thread > - loop_process_work > - do_req_filebacked > - lo_rw_aio > - lo_rw_aio_complete > - blk_mq_end_request > - blk_update_request > - f2fs_write_end_io > - dec_page_count > - folio_end_writeback > - kill_f2fs_super > - kill_block_super > - f2fs_put_super > : free(sbi) > : get_pages(, F2FS_WB_CP_DATA) > accessed sbi which is freed > > [...] Here is the summary with links: - [f2fs-dev] f2fs: fix to avoid UAF in f2fs_write_end_io() https://git.kernel.org/jaegeuk/f2fs/c/ce2739e482bc You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html