From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-233.mail.qq.com (out203-205-221-233.mail.qq.com [203.205.221.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62F942A1BF for ; Sat, 18 Apr 2026 06:07:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.233 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776492452; cv=none; b=kPFYdv0kjshO1IyClmu7fKLY6neFUO8cHVxlpjtY4O2Gm/5eemFXhGlrLuO/wXKvuh2I9qdueHXWolP2CSa9GxZpMDH8M5HQFpFvP1s07ayCUu3ckKMxvUDlZVS4lmiuloJYCL/imrrZW/aJPf3sdJ2s3xtvMMq+jNLWKXYtDWg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776492452; c=relaxed/simple; bh=7zzqp4EHy2n+ylrjed4NC3hUsmiwXqpSvg/JB3/nF6g=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=unb4m2qVGSndbxzaP67K97XNt+0O+z2EavhDbSfmz1jv6dCwsi+ajgDRpxjHsQcL4MFL2HWcHrSKhhJuAd8ZYJGoAEa6bHly/TuQMj7puhyXzr84tfxCZuzprafvzuAs+aAWaIul7lkHPcvcWaZotlqEADGJtAzUHay9zX2wyOo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=wlBLQ2NG; arc=none smtp.client-ip=203.205.221.233 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="wlBLQ2NG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1776492441; bh=Nb9gQMbpkpXAp/D9XpeN41nG36bkd79PpI1RvgwmiGw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wlBLQ2NGzpgaq7w0ll5DneBPD6ppAqcvXcztvuJL2Qgw8/GgBnNXs9z7fAHMWnXCj 0PBMYobnMADapRwwezmaRHO9f2SXVu0Wu0gyPaLFzjPTEv9SYRPkXh/Omv3g1f6ENr PAso+gCoz/UDSn3KE//lTX8SsLRAd+jTuiD2zoeM= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc56-0.qq.com (NewEsmtp) with SMTP id 1D2B9077; Sat, 18 Apr 2026 14:07:18 +0800 X-QQ-mid: xmsmtpt1776492438tl1s0xuum Message-ID: X-QQ-XMAILINFO: N0wO3GTqxQkwKA5LP5Qcyl7A4yHfojUyLsVBOOvBPjI3KYfeZFrKPok0C3TRcH e9UqBwXRM4IvVKoBu8IrgbBelHJCp3LvmUrCC1Z38Z6wkrbcoKrk0I5gtv6bBPh0aAXgYgiUFgz6 +q2v+tyTDfmVJ1zpHKOSiWlEH7lOgppwycdq79BbXZERC2oDrXjTWiNYpAR/2QZ0F3vvgll3fVo8 Fdw3qT8E1JlgDPHZ2sFvCUZer/Uq0nGuLUzfbSz20YmZcBeoaulcxiXSGoJStwCG1E6dYcxnz9by ecw0Lo/9t5HDtdRcJMxCRIAOnFxVC1kKelFUc3NvGaJXSwcpbGdWHXqyAYKFtyJJohbPTqvfw4xg w7taSn4yXxYKcy39oxt7/U/9xt/qH7sShb8FsZGVp5lYrGeJrjrnc8eGDrCdGxxhJYBcKzPYJ0bb 09hR8YlJyWjEIjEAepS6lmABXlIjW6UHXYjUGF8vFzLhNzVPHIl1y/sZpoMhQZ/aJQ/FhNiCsDIx LuPXIDUDGreske5+HJwq0YhGFyDiHmSDiXAyseTLPBjHz2ggpTCxgqFY/SddHM0hXlUwtMYBbvP5 menZPr9lI1js//ZgbEzfe4THuxelSQUSgJ5943xp3Kqt8AAhf4P2Kae4ZX5ADhWR91DccqwJl4xW lUxt3VfOQi2RwzmurQXtOUJhrHJLii+wfdRNpB6QS/46cwWq+L2wshzs2h2HuR+LJTyy1DAxCEqY 6YLQcHVpedam8LT6CKAhyIWODb1eyV86QvIQSyGpXtqO2qXOUw77AQqZw/oPG2rUNOUPkalokaci kF4z5pwLAiMJ1MGRjvPkEeJd/09U2Tkr7S8IXCc8+uT0uXItBgyrsyhkz+RZlTOLGp9XN3xW6Pqy os8PFBLpsEoVEnDETj9aGRkfMtHgiiGKy5nkqUQ4JwxceyehcgiUtxHEE+JSHXZZd2AQA1t6xu0/ G25B+ItGOdoR0yVVi/OHG9by7eTG6XCJkmhbWZcILDVnVzNbB9RPSA8GhEdL+2AJ8NUc1Uba97b2 MQZe7ojA9/tTMSIa8oTOESfFBO1/mPty9xiBzluKQcir896XFOC5VdPaVZzCA= X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== From: Edward Adam Davis To: syzbot+ecf51a7ccb6b1394e90c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lbmIODone Date: Sat, 18 Apr 2026 14:07:19 +0800 X-OQ-MSGID: <20260418060718.457330-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69df5517.a00a0220.468cb.0074.GAE@google.com> References: <69df5517.a00a0220.468cb.0074.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index 306165e61438..f795f19d24bb 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1984,7 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp) submit_bio(bio); } - wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD)); + wait_event(bp->l_ioevent, (bp->l_flag & lbmDONE)); return 0; } @@ -2192,9 +2192,6 @@ static void lbmIODone(struct bio *bio) if (bp->l_flag & lbmREAD) { bp->l_flag &= ~lbmREAD; - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); - goto out; } @@ -2217,10 +2214,8 @@ static void lbmIODone(struct bio *bio) log = bp->l_log; log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor; - if (bp->l_flag & lbmDIRECT) { - LCACHE_WAKEUP(&bp->l_ioevent); + if (bp->l_flag & lbmDIRECT) goto out; - } tail = log->wqueue; @@ -2271,8 +2266,7 @@ static void lbmIODone(struct bio *bio) * leave buffer for i/o initiator to dispose */ if (bp->l_flag & lbmSYNC) { - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); + goto out; } /* @@ -2298,6 +2292,8 @@ static void lbmIODone(struct bio *bio) out: bp->l_flag |= lbmDONE; + /* wakeup I/O initiator */ + LCACHE_WAKEUP(&bp->l_ioevent); LCACHE_UNLOCK(flags); }