From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74B8B33937F for ; Tue, 4 Aug 2026 06:08:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785823717; cv=none; b=BX1gHxLKIfvWptx6AjIndTh2HAfWJudio9gFYM4HfUFk+w72Rva44FIRXGMJLao98KX1+mF1zmpD5n1IuGazYCuQt1ZnCjb8M5xC4L4ZuU1DEElW8Zc2SYVu0/2h7OLB1CVnnq3O3/onlpLi7UIcUhaFsEQ5h8Oh3P8sJd0hlIc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785823717; c=relaxed/simple; bh=BhiRJ+d7bcq41p8etlP2z53iZ4IbfR3FF1tY8HTpSsY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=C6wM5OKOhBZdoIUAWYCgLt1oj83IQKz7UUXA9ntL9ubhuDGE3/b9l/D7k8v1HQW4hLa95w+JQmR64X7NzuxDdgODZCNR6tW60/GoUl2LAQsC7OF/dRUVX5WQk3jqPtLCj+EZjAk9shXHDhDweK/R+LxVML6XpqJjdm/lOPeOY+Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=JXI45Pke; arc=none smtp.client-ip=209.85.222.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="JXI45Pke" Received: by mail-qk1-f175.google.com with SMTP id af79cd13be357-92e65e18969so51510885a.1 for ; Mon, 03 Aug 2026 23:08:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1785823714; x=1786428514; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=tRSrHef44ap8Eqx1u9RGqbYgPVXMv+bUp1iAeOg/uVA=; b=JXI45PkekCeKDsCUFyrB5SxV6uroe4AEhLny9LviIkj1zhFaISSZaRskrcK+xmGKLc NJNESo8Q+CsUjhJk3kRsqQSrnLbd0jk9z6V2FFjb5Ia7QcVDUD2b8zmJa937vkWHLrt2 xCn/ZFBolN0/COJzXeAsVF1THopXOktfM/u6qxP2QX63RzgDxIvCDTpRZtOJCfaq5AxA j5yy5iuZIT0qxpEtNvn+zNyZ030CSvxTvzhrl9tcuAGN2SK7AEM/mOmfj8T559tBVi66 rq8GSQn9sN56ot8Pg3EMv7gXitPWWO5Uug8zp0k1zSvo5cdTrbwQHfMlo1l+b/w8dCWo En6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785823714; x=1786428514; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tRSrHef44ap8Eqx1u9RGqbYgPVXMv+bUp1iAeOg/uVA=; b=QeL2N2Gs4wi3T7Qp6pz5dV/8B/NhxI+tI3us7dbkQZTRMbt7kj0Fc8QvZ+6fpvbIyR ENdm0ejIcZcovqsgcpB+HVOQ79gvAUqeffWdvG9tbHJ4Ij2q65bljfB6z0+APKLwS27T f8b4McLuZccxDf1Zgxb5OBcE37o7ZUZHEFA8JY2pHrKswGYudjiwf3ViOD1uqGK/2wW7 P3wY1HBAdaBYdCbEhMDJc8fK3ntKZ1o4iHFi138dgziCRAQgcMHa+6rPvllkpcEyO6Po 3hZr10vXb0v43BB3vLiP2mj/YoqRGTZiSrWeyWG7TdiRX6Im/xgVvtLeTwemE0TFWUTL wiTA== X-Forwarded-Encrypted: i=1; AHgh+Rqv7sDbDdB6hBtpJhoGwIZ9eBalO4h+lky3JYXRuOsqjPcyCMKC8W3q1raWTx0Q7A6XybIbApihHC1pQwc=@vger.kernel.org X-Gm-Message-State: AOJu0YybO9edOSmOOb+fqpswWk39zstSuFSee0EOv7otd9rytYBe3Bnz nRt+4pOtun6eaRY/Xq5I0QkpcaF8kF2nPBf9rsa88UeCuH9wJXDqr+s12Rg7/SE5bO8= X-Gm-Gg: AR+sD11ZcJeBpnJYI1z4CnOPCeoUWDBELP+cXS7h4PO3DoIRvJ/R1hem41B3mbJw0VE bsxxJsSE2b6YD7OcOj2knP2zZ+vZhO4lb9I3A+wAfUeMKqZkqdb32R7Vlp2WEKcB0Ed6lWS1Es7 eG0LdnWV8/hLwO9ZTeBSVgdXmDX33jd5n2UGa/yyifvT2VnQ57qd4Nb+q6/erJ4ubSxfkSU/VOp 6qIabpjCcWjOagVVfgyTpgrFLfeW8LPtW9TtVlVL0s2fvqNfjHnbCDn3AgfzavQJxA2Bq5FDNEz whfGhESZyLP2GRPLmZHFM0eC21H8Ss2w051oiStFVJK+riI/XGepycKoE2HTW4STKUr1keKI+9r fvcJOPkOC00CTc131qGdUNDx4EnqoucJAIi0184+g6iv4WwSCRqv7JQM3nAEV6GUTl4f7MYaXJK LqKco+BsVW+L+M5w+463+uTExUxBIw8EJDxFEsb9at5FwEpAbB9wbH1XFG+PteMs1/dt3aw7CjF 7sW X-Received: by 2002:a05:620a:4c98:b0:934:b798:c245 with SMTP id af79cd13be357-9363191f791mr283186585a.16.1785823714317; Mon, 03 Aug 2026 23:08:34 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id 6a1803df08f44-9084360708csm92469316d6.45.2026.08.03.23.08.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 03 Aug 2026 23:08:34 -0700 (PDT) From: David Lee To: shaggy@kernel.org Cc: Kyle Zeng , Dominik 'Disconnect3d' Czarnota , Sven Eckelmann , jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, David Lee Subject: [PATCH v2] jfs: pin metapage during synchronous writeback Date: Tue, 4 Aug 2026 06:08:32 +0000 Message-ID: <20260804060833.711251-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Kyle Zeng release_metapage() decrements mp->count from one to zero but keeps the struct metapage pointer in its local variable mp. For synchronous writeback, release_metapage() calls metapage_write_one(), which in turn calls metapage_write_folio(). metapage_write_folio() clears META_dirty, submits the I/O, and this unlocks the folio while synchronous I/O is in progress. After writeback completes, kswapd can acquire the folio lock before release_metapage(). metapage_release_folio() then sees mp->count == 0 and META_dirty clear, removes mp from the folio, and frees the struct metapage. release_metapage() subsequently reacquires the folio lock and passes its now-dangling mp pointer to drop_metapage(), which does an use-after-free read of mp->count. Increment mp->count before calling metapage_write_one(), and decrement it only after release_metapage() has reacquired the folio lock. The nonzero count makes metapage_release_folio() leave the struct metapage allocated throughout the unlocked writeback interval. Once release_metapage() holds the folio lock again, it can drop the temporary reference and safely finish using mp. Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber Signed-off-by: Kyle Zeng Co-developed-by: David Lee Signed-off-by: David Lee --- Changes in v2: - Restore Kyle Zeng as the patch author and correct the sign-off chain. - Move the research credit below the commit-message separator. v1: https://lore.kernel.org/all/20260731110008.543282-1-david.lee@trailofbits.com/ Bug found and triaged by OpenAI Security Research and validated by Trail of Bits. Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed. fs/jfs/jfs_metapage.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c index 41fe12e641ce..d1962a44125a 100644 --- a/fs/jfs/jfs_metapage.c +++ b/fs/jfs/jfs_metapage.c @@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp) folio_mark_dirty(folio); if (test_bit(META_sync, &mp->flag)) { clear_bit(META_sync, &mp->flag); + /* Pin mp while metapage_write_one() drops the folio lock. */ + mp->count++; if (metapage_write_one(folio)) jfs_error(mp->sb, "metapage_write_one() failed\n"); folio_lock(folio); + mp->count--; } } else if (mp->lsn) /* discard_metapage doesn't remove it */ remove_from_logsync(mp); -- 2.53.0