[PATCH v2] jfs: pin metapage during synchronous writeback

[David Lee <david.lee@trailofbits.com>]

From: Kyle Zeng <kylebot@openai.com>

release_metapage() decrements mp->count from one to zero but keeps the
struct metapage pointer in its local variable mp.  For synchronous
writeback, release_metapage() calls metapage_write_one(), which in turn
calls metapage_write_folio().  metapage_write_folio() clears
META_dirty, submits the I/O, and this unlocks the folio while synchronous
I/O is in progress.

After writeback completes, kswapd can acquire the folio lock before
release_metapage().  metapage_release_folio() then sees mp->count == 0
and META_dirty clear, removes mp from the folio, and frees the struct
metapage.  release_metapage() subsequently reacquires the folio lock
and passes its now-dangling mp pointer to drop_metapage(), which does
an use-after-free read of mp->count.

Increment mp->count before calling metapage_write_one(), and decrement
it only after release_metapage() has reacquired the folio lock.  The
nonzero count makes metapage_release_folio() leave the struct metapage
allocated throughout the unlocked writeback interval.  Once
release_metapage() holds the folio lock again, it can drop the temporary
reference and safely finish using mp.

Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
Changes in v2:
- Restore Kyle Zeng as the patch author and correct the sign-off chain.
- Move the research credit below the commit-message separator.

v1: https://lore.kernel.org/all/20260731110008.543282-1-david.lee@trailofbits.com/

Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.

Trail of Bits has a reproducer for this bug that triggers a
KASAN use-after-free and can share if needed.

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..d1962a44125a 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0