From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-233.mail.qq.com (out203-205-221-233.mail.qq.com [203.205.221.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97F7F26AC3 for ; Sat, 18 Apr 2026 05:55:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.233 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776491708; cv=none; b=g5dlKg+bpN5VqmNkUNQeVux5zZKteeILHGvmq+6uyiruBge8mrtEU6JSqFZPFim5uuq1ZPrJwqcL5T79DuJ+Tnxz/xx49Ckh6wtK/QWH/zAAAr4axri8ND+Gixgcm/eLU+B/CvHYfG0ai1vRk0uIx05IgNS366mbMBA669+Xjtg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776491708; c=relaxed/simple; bh=X8T2s0HRTtmn8ET+727Ir4RWoW5siWeUevGm3yLrRHg=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Hi5k3E4pH273cxhEZt4Rla0gLLKD0x8Kvrff8SuA0zvoKW/wYeqlexvsDXmq+E8y0dZe4N155IFkPQ3sOk/FqSVOd1G6iwPU5QGu57EEk+9TRyTQ0JFOQa5LNGzi4800C6cuguaNRIvYDdpmrYUgqVubdBV0KN3rlb1Gt4Enh/8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=UA1xLAAr; arc=none smtp.client-ip=203.205.221.233 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="UA1xLAAr" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1776491702; bh=X1GOjLqvkuCp4hzvEOQg+ZZ7SK+zmTbYC+mNRxaglPA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UA1xLAArulcA0thEl/lUDt9e910hFKs+dHDSLgGmCApZ/o+2NW4BxOKdxPdvfxHwA EPk5zi7sQEGNuiWWoJ6K5tHZ1qrlcsQLdsCZoR7V+niCYJa5hwDiDTBSzph7zMODt2 X7WUqIOyA9kADLgzy4dFwY01toQ3Wjg1nDPB0y+o= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszb51-0.qq.com (NewEsmtp) with SMTP id DC02D806; Sat, 18 Apr 2026 13:55:00 +0800 X-QQ-mid: xmsmtpt1776491700tdso7k7df Message-ID: X-QQ-XMAILINFO: M1rD3f8svNzn8r7KyFIY9ejvYKnCduhlPBd0OW6dqypWlHJ6awD53uBQHr8mff WhrV+Pr3X/n5TUQMwcA26W9mNsIsI3YipJnHvUcVjjpsiiqUGDCVTTtgW8IhpKXZjfYdB5U2X/oc sW+CUUFSfWQbrAytbHtiv148wdl/p96cltBf4QEFPAH9GORyerhI3uvZNUR35ZeU5dQIi2UveQ8j jJCC/otcbO/26lOlowNbyNJNQzU9sOZZS9AwUF4sjWLwDgUY25bQeSAcLDOsLAL+3djX7tYclKko mvA4k8foqTrDIyGygwxe5Duy8OzNIrOga2FxI3FJ4vc9ETiZRlqkHR4XRizVCgKk1/K6aT5Jw4pO ba+M++aDv+Y6Cu9w/vPQT3Uj90cxR0h8BGzVlz+ORd2H2F90ToKObD1XHTeHE0DctI0eAv2eVaWS 6ENxV15sUe03YApE4/wK3/e78TCQhr3nWYJ4034Z/T3ftpITNCXLo9p4mbpr4M6q+Rtd90SgHHGU RAhruwZzX/ScFjCWfO0CsMMo7sTBN4n6u5FiMHJZR+UAyPZk8pQmELv1dt5oEjhmq9BgEQLBeVi6 ST3pLmYMEpRDjnd9BYPBOXQcdfSJ04G1KDYRccFT9EHw23ik0UcHAEy1TfiLhictiJkaeI+EQr1n ePcNAqGz9bPYeLi+g6oqlUt0hv8wCmH5cY6BhbxNMwU7DptQd4S/PzibGBEXQvFrc4ldmvDP7ZHO goTCqGVxt6GRi4aKDVG8XNYCKyvCEOHsbqoIX+24TPgj8eeQ9LvecOhdJGyoXO26O1FqjvnSRZ0J 1LxM1aoHyWYXubXIGLjzb0/XMf4onCPdxrHkBgiChyOzR+r9PqNySi6NkYVOU1qEkrMsvzjVhHi4 DDLhw2GGQZbF6hg7eQVyL0vuoesIMAR1GdoFJsLno8lHIKoUcMApNbbiYd0vEZkvqJoiT1gco7OD T1OXfGdI1LJh5QZKRoBswN+Reuj7ydNhLJ9rAADOJWMnZWWgvDYXQLGTO+nAT6cNddP1Q8KTL4KT ioxU2ILQ== X-QQ-XMRINFO: Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg== From: Edward Adam Davis To: syzbot+ecf51a7ccb6b1394e90c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lbmIODone Date: Sat, 18 Apr 2026 13:55:01 +0800 X-OQ-MSGID: <20260418055500.456414-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69df5517.a00a0220.468cb.0074.GAE@google.com> References: <69df5517.a00a0220.468cb.0074.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test: upstream master diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index ada00d5bc214..729baf49a048 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1986,7 +1986,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp) submit_bio(bio); } - wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD)); + wait_event(bp->l_ioevent, (bp->l_flag & lbmDONE)); return 0; } @@ -2180,7 +2180,6 @@ static void lbmIODone(struct bio *bio) LCACHE_LOCK(flags); /* disable+lock */ - bp->l_flag |= lbmDONE; if (bio->bi_status) { bp->l_flag |= lbmERROR; @@ -2196,12 +2195,7 @@ static void lbmIODone(struct bio *bio) if (bp->l_flag & lbmREAD) { bp->l_flag &= ~lbmREAD; - LCACHE_UNLOCK(flags); /* unlock+enable */ - - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); - - return; + goto out; } /* @@ -2224,9 +2218,7 @@ static void lbmIODone(struct bio *bio) log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor; if (bp->l_flag & lbmDIRECT) { - LCACHE_WAKEUP(&bp->l_ioevent); - LCACHE_UNLOCK(flags); - return; + goto out; } tail = log->wqueue; @@ -2278,10 +2270,7 @@ static void lbmIODone(struct bio *bio) * leave buffer for i/o initiator to dispose */ if (bp->l_flag & lbmSYNC) { - LCACHE_UNLOCK(flags); /* unlock+enable */ - - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); + goto out; } /* @@ -2290,6 +2279,7 @@ static void lbmIODone(struct bio *bio) else if (bp->l_flag & lbmGC) { LCACHE_UNLOCK(flags); lmPostGC(bp); + LCACHE_LOCK(flags); /* disable+lock */ } /* @@ -2302,9 +2292,12 @@ static void lbmIODone(struct bio *bio) assert(bp->l_flag & lbmRELEASE); assert(bp->l_flag & lbmFREE); lbmfree(bp); - - LCACHE_UNLOCK(flags); /* unlock+enable */ } +out: + bp->l_flag |= lbmDONE; + /* wakeup I/O initiator */ + LCACHE_WAKEUP(&bp->l_ioevent); + LCACHE_UNLOCK(flags); /* unlock+enable */ } int jfsIOWait(void *arg)