[PATCH v2] jfs: pin metapage during synchronous writeback

[PATCH v2] jfs: pin metapage during synchronous writeback

[Bruno Produit]

release_metapage() decrements mp->count to zero before it starts a
synchronous write. metapage_write_one() drops the folio lock while it
waits for writeback, but release_metapage() retains mp and dereferences
it after taking the folio lock again.

Once writeback clears META_dirty and ends, reclaim can lock the folio
first. metapage_release_folio() then observes a zero count and frees mp,
leaving release_metapage() with a dangling pointer.

Add a separate writeback counter that metapage release and reclaim both
honor while synchronous writeback has dropped the folio lock. Keep it
separate from mp->count so concurrent writers can still reach the final
release path and propagate META_dirty to the page cache.

Fixes: 7fab479bebb9 ("[PATCH] JFS: Support page sizes greater than 4K")
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: syzbot+f1521383cec5f7baaa94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1521383cec5f7baaa94
Assisted-by: Codex:gpt-6
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
 fs/jfs/jfs_metapage.c | 9 ++++++---
 fs/jfs/jfs_metapage.h | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

v2: Following the Sashiko review at 
https://sashiko.dev/#/patchset/20260922110754.1804555-1-bruno.produit%40trailofbits.com,
use a separate writeback counter to preserve concurrent dirty writes.

The syzkaller issue has the same crash and root cause, although its public
reproducer did not trigger KASAN in local runs. A separate reproducer
reliably triggers the KASAN use-after-free under reclaim pressure.

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..1c388eb4af2b 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -269,6 +269,7 @@ static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
 		mp->data = NULL;
 		mp->clsn = 0;
 		mp->log = NULL;
+		mp->writeback_count = 0;
 		init_waitqueue_head(&mp->wait);
 		INIT_LIST_HEAD(&mp->synclist);
 	}
@@ -309,8 +310,8 @@ void metapage_exit(void)
 
 static inline void drop_metapage(struct folio *folio, struct metapage *mp)
 {
-	if (mp->count || mp->nohomeok || test_bit(META_dirty, &mp->flag) ||
-	    test_bit(META_io, &mp->flag))
+	if (mp->count || mp->nohomeok || mp->writeback_count ||
+	    test_bit(META_dirty, &mp->flag) || test_bit(META_io, &mp->flag))
 		return;
 	remove_metapage(folio, mp);
 	INCREMENT(mpStat.pagefree);
@@ -623,7 +624,7 @@ static bool metapage_release_folio(struct folio *folio, gfp_t gfp_mask)
 			continue;
 
 		jfs_info("metapage_release_folio: mp = 0x%p", mp);
-		if (mp->count || mp->nohomeok ||
+		if (mp->count || mp->nohomeok || mp->writeback_count ||
 		    test_bit(META_dirty, &mp->flag)) {
 			jfs_info("count = %ld, nohomeok = %d", mp->count,
 				 mp->nohomeok);
@@ -882,9 +883,11 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			mp->writeback_count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->writeback_count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
diff --git a/fs/jfs/jfs_metapage.h b/fs/jfs/jfs_metapage.h
index 2e5015c2705b..12368314b2da 100644
--- a/fs/jfs/jfs_metapage.h
+++ b/fs/jfs/jfs_metapage.h
@@ -31,6 +31,7 @@ struct metapage {
 	/* Journal management */
 	int clsn;
 	int nohomeok;
+	unsigned int writeback_count; /* Synchronous writeback users */
 	struct jfs_log *log;
 };
 
-- 
2.53.0

[PATCH v2] jfs: pin metapage during synchronous writeback

[David Lee]

From: Kyle Zeng <kylebot@openai.com>

release_metapage() decrements mp->count from one to zero but keeps the
struct metapage pointer in its local variable mp.  For synchronous
writeback, release_metapage() calls metapage_write_one(), which in turn
calls metapage_write_folio().  metapage_write_folio() clears
META_dirty, submits the I/O, and this unlocks the folio while synchronous
I/O is in progress.

After writeback completes, kswapd can acquire the folio lock before
release_metapage().  metapage_release_folio() then sees mp->count == 0
and META_dirty clear, removes mp from the folio, and frees the struct
metapage.  release_metapage() subsequently reacquires the folio lock
and passes its now-dangling mp pointer to drop_metapage(), which does
an use-after-free read of mp->count.

Increment mp->count before calling metapage_write_one(), and decrement
it only after release_metapage() has reacquired the folio lock.  The
nonzero count makes metapage_release_folio() leave the struct metapage
allocated throughout the unlocked writeback interval.  Once
release_metapage() holds the folio lock again, it can drop the temporary
reference and safely finish using mp.

Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
Changes in v2:
- Restore Kyle Zeng as the patch author and correct the sign-off chain.
- Move the research credit below the commit-message separator.

v1: https://lore.kernel.org/all/20260731110008.543282-1-david.lee@trailofbits.com/

Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.

Trail of Bits has a reproducer for this bug that triggers a
KASAN use-after-free and can share if needed.

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..d1962a44125a 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0