From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 258D938A70A for ; Wed, 17 Jun 2026 10:51:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781693521; cv=none; b=KO8qxNO7jDAtAjOYWiPG22GE17ZEl+tEi8CbNzdg/wWzzr6X6MGpgnkcO74ikXnNqJGH7EIGSLMOk6Tr/hK89iWAMRcirYo+pOjOEX3Y8LYfYqlUDxGuSw7HY6CvBzCommSU1wsQMt8JjV1EUTcCieQmqsaFyAsSNTlfBKV7VvA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781693521; c=relaxed/simple; bh=P61yXoFT55LCqdtv8dojNfoxbvuQPGVSIrZJbPV4rVU=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=YniIHOuk83y9ApbsNb9bix4ViYvWJwx/V0TnZlO+YpriYAiceqZZYU2S0gtcCNzP4jyfm/nLDB5kjCquVz42WzLQ3mTryVIwZpJz1wHywuzv96hriNikO1jYnHtSiYoE+oBBA1ab5VZltYUOOhxn0NIGOZ9i6ldRV9o/mv9Vkus= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LszZcJ0q; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=eRuH4U47; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LszZcJ0q"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="eRuH4U47" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1781693519; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Bkr4SAhPMDT9px8dL8O1ncJ6XM9d7F5rRlhMTmcXksE=; b=LszZcJ0qkN9akmEK0UKyeLmUYepriHvwq0LGz0S0tYCedlXtDG1elX0eVASG+nh462oF2B UV9rWJqtJECIcm6oKZpnglhpan9sq23L/+NozhDPaOVObrkvuSi8WBffbb7wWOkxae8McD RsphR6ej1kQIZhL6zhHMFm7ATQVp9p0= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-385-d1Vz8vukNfO0jpuQnyPFgg-1; Wed, 17 Jun 2026 06:51:57 -0400 X-MC-Unique: d1Vz8vukNfO0jpuQnyPFgg-1 X-Mimecast-MFC-AGG-ID: d1Vz8vukNfO0jpuQnyPFgg_1781693517 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-45efb6e60e4so5007245f8f.0 for ; Wed, 17 Jun 2026 03:51:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1781693516; x=1782298316; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Bkr4SAhPMDT9px8dL8O1ncJ6XM9d7F5rRlhMTmcXksE=; b=eRuH4U47uHrbuImdujz72uXAYPVKHk6uNJD3fdiBpTnlLepJs2hNWVTY8MK7yGDkwO 9VANbINkhgFbnwz8G1fPA+NHhZyEdVjE13v/OUq4LY0t7x79ftdmJktHxnb4cYXhOlb7 2Ll+iRpijxxk7zJItbBzELVvsDRImUg8cGOacFagnhxmSQA5ZYsDHHxJfmfN7/6wbpcZ xrywjeNoH5XMvoKSE15QybR0b75YM+RxdDFfR0GEAn+F44q3hhkg0HDXs9pFqui50lUr VSHyWUAMr0xGjw29GmhzrjlnjD1FOG9D4bLOi1pjEG83uFnmvNd4FLqZzCFWgF1gBmFF fJYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781693516; x=1782298316; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Bkr4SAhPMDT9px8dL8O1ncJ6XM9d7F5rRlhMTmcXksE=; b=TjR6p6sKaPPttv+4JqLK7uMnCG740J+2kvJy1deVeJOPL+8MSINjBKD3KNap1iefYV G/BXjOWdUwZ999FWzVz+etr5hAUbn2yWySZw2soLWgEjDumdyGaUkzTRAQD2EbqpL+2d OvrXsdZvGvoGy+H69IBDAG9S7nT+byH2CSlDz91pDpnFLdXNrYrcZ64wSCr9zvTmLllp titX7UGKdw0J2GBhbb6MxMVV2R1iQyOme/YZjwrVwtoennPMhK+UgI7G0zDH76QhCwzt WpJBRQ+QIcKEwWtrJ558XggrMQ0hRa9Sg3TjLZZwkJAJNREq6sBftgtV9ej+ZmWO0CN4 6VQQ== X-Forwarded-Encrypted: i=1; AFNElJ/9eJHlpEuHCLu6Mze886j+w46B6ZiaN15zs3YjkuVzjmfJw5mcFAm4rd6JH6qqOMqzI38a4EIkmmy7y9o=@vger.kernel.org X-Gm-Message-State: AOJu0YyzXG5ecSiI+sgiW84QGf605QljUi3TPWhAPWW0SzNkRgaHFEQd CIjw0MIek1L6V6H27OdwrqRt8sQQngp/z5lz/II17x6g5T4YliGGPSzyy5/CYfM2LBxXWo9OZav xG8l5OHrq4tr4gmEosHZ5bZhJ/LPnwPF8woYnHc8MFOcBxR9+zXEioL9dq+uXIo8oEA== X-Gm-Gg: AfdE7ckvsKlB8POW5hqqiaorlljEZOdPyqqkfnNR4goK3+vmlWF3XSObPvWfB+XRk7F u1qAxHT91PWIYuefkBx2BbY9HWWnDOPBDJSsaNNuHXsmCL45N+JHnvWRERFhdvmx29tmYCM2HpW aAClgZ8PROsA1OzqF1FcDLIaYCFNDA46uOchSlzdTqjEjeg9i9/f8IE/iSVcnf2GiKduOmi1B9G GpdqLfava+jsA4X46yZpyOLd2KJbsbrQhFe3UgrEKLVeu3eAA9IRslKZFQoOvhpg9KKe6dPeQ4x Mv2E4JKTkDLDxomqw9MJwBp7ln0QSSdJu7gj066RlvluJAgfrc5S5wr5EVQBqdBnFy2VqtzVQV7 bVpngW4fbPP0g2xYKM3f8BEei8B78XHJ7U0KPWzlo/JmDuKnGYpY8BEgUCrapMRP5vXUrvbI= X-Received: by 2002:a05:6000:288b:b0:45e:6518:21ad with SMTP id ffacd0b85a97d-4623521ab30mr5946604f8f.3.1781693516633; Wed, 17 Jun 2026 03:51:56 -0700 (PDT) X-Received: by 2002:a05:6000:288b:b0:45e:6518:21ad with SMTP id ffacd0b85a97d-4623521ab30mr5946527f8f.3.1781693516034; Wed, 17 Jun 2026 03:51:56 -0700 (PDT) Received: from [192.168.1.167] (cpc76484-cwma10-2-0-cust967.7-3.cable.virginm.net. [82.31.203.200]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4620b1083e3sm8660654f8f.20.2026.06.17.03.51.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 17 Jun 2026 03:51:55 -0700 (PDT) Message-ID: Date: Wed, 17 Jun 2026 11:51:54 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] gfs2: Fix use-after-free in gfs2_remove_from_journal() Content-Language: en-US To: Hongling Zeng , agruenba@redhat.com, swhiteho@redhat.com, gregkh@linuxfoundation.org Cc: gfs2@lists.linux.dev, linux-kernel@vger.kernel.org, zhongling0719@126.com References: <20260617090143.735219-1-zenghongling@kylinos.cn> From: Andrew Price In-Reply-To: <20260617090143.735219-1-zenghongling@kylinos.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 17/06/2026 10:01, Hongling Zeng wrote: > The function calls brelse(bh) but then continues to access > the buffer head through bh->b_private, clear_buffer_dirty(), > and clear_buffer_uptodate(). > > After brelse() decreases the reference count, the buffer head > may be freed, making the subsequent accesses use-after-free. When buffers are pinned their refcount is incremented and the brelse() here is only called for pinned buffers so I'm not convinced that there's a bug. Callers of gfs2_remove_from_journal() also use the bh afterwards so if there was a use-after-free this patch wouldn't fix it. Did you see a use-after-free in testing? Andy > Fix by moving the brelse(bh) call to the end of the function, > after all accesses to bh have been completed. > > Fixes: e93b100931a4 ("GFS2: Fix slab memory leak in gfs2_bufdata") > Signed-off-by: Hongling Zeng > --- > fs/gfs2/log.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c > index 78bba8cc10b8..a92c84146de9 100644 > --- a/fs/gfs2/log.c > +++ b/fs/gfs2/log.c > @@ -1038,7 +1038,6 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta) > set_bit(TR_TOUCHED, &tr->tr_flags); > } > was_pinned = 1; > - brelse(bh); > } > if (bd) { > if (bd->bd_tr) { > @@ -1056,6 +1055,8 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta) > } > clear_buffer_dirty(bh); > clear_buffer_uptodate(bh); > + if (was_pinned) > + brelse(bh); > } > > /**