[PATCH] jfs: pin metapage during synchronous writeback

[PATCH] jfs: pin metapage during synchronous writeback

[David Lee]

release_metapage() decrements mp->count from one to zero but keeps the
struct metapage pointer in its local variable mp.  For synchronous
writeback, release_metapage() calls metapage_write_one(), which in turn
calls metapage_write_folio().  metapage_write_folio() clears
META_dirty, submits the I/O, and this unlocks the folio while synchronous
I/O is in progress.

After writeback completes, kswapd can acquire the folio lock before
release_metapage().  metapage_release_folio() then sees mp->count == 0
and META_dirty clear, removes mp from the folio, and frees the struct
metapage.  release_metapage() subsequently reacquires the folio lock
and passes its now-dangling mp pointer to drop_metapage(), which does
an use-after-free read of mp->count.

Increment mp->count before calling metapage_write_one(), and decrement
it only after release_metapage() has reacquired the folio lock.  The
nonzero count makes metapage_release_folio() leave the struct metapage
allocated throughout the unlocked writeback interval.  Once
release_metapage() holds the folio lock again, it can drop the temporary
reference and safely finish using mp.

Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed.

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..d1962a44125a 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0

Re: [PATCH] jfs: pin metapage during synchronous writeback

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 1009 bytes --]

On Friday, 31 July 2026 13:00:06 CEST David Lee wrote:
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.
> 
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

1. weird advertisement at the end of the commit message which should either be 
   below the three dashes or written using the normal Tags 
   https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
   (and all these tag/format related sections below)

2. author didn't sign off the patch (see below)

3. odd unrelated Signed-off-by without any obvious connection to 
   the patch

   - I actually would guess that Kyle Zeng <kylebot@openai.com> is the author 
     and David Lee removed its authorship (From: ) before sending the patch.
     But in its current form, David is claiming to be the author. And even
     when it is the case, David must still add the the non-Author SoB at the
     end.

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH] jfs: pin metapage during synchronous writeback

[Bruno Produit]

From: Kyle Zeng <kylebot@openai.com>

release_metapage() decrements mp->count to zero before it starts a
synchronous write. metapage_write_one() drops the folio lock while it
waits for writeback, but release_metapage() retains mp and dereferences
it after taking the folio lock again.

Once writeback clears META_dirty and ends, reclaim can lock the folio
first. metapage_release_folio() then observes a zero count and frees mp,
leaving release_metapage() with a dangling pointer.

Increment mp->count across the unlocked interval. This makes
metapage_release_folio() reject the folio until release_metapage()
holds the folio lock again and can safely drop the temporary reference.

Fixes: 7fab479bebb9 ("[PATCH] JFS: Support page sizes greater than 4K")
Reported-by: syzbot+f1521383cec5f7baaa94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1521383cec5f7baaa94
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
The syzkaller issue seems to be the same, although the syzbot repro
does not trigger KASAN on my side. Trail of Bits has another reproducer
for this bug that triggers a KASAN use-after-free and can it share if needed

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e..d1962a4 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0