release_metapage() decrements mp->count from one to zero but keeps the
struct metapage pointer in its local variable mp.  For synchronous
writeback, release_metapage() calls metapage_write_one(), which in turn
calls metapage_write_folio().  metapage_write_folio() clears
META_dirty, submits the I/O, and this unlocks the folio while synchronous
I/O is in progress.

After writeback completes, kswapd can acquire the folio lock before
release_metapage().  metapage_release_folio() then sees mp->count == 0
and META_dirty clear, removes mp from the folio, and frees the struct
metapage.  release_metapage() subsequently reacquires the folio lock
and passes its now-dangling mp pointer to drop_metapage(), which does
an use-after-free read of mp->count.

Increment mp->count before calling metapage_write_one(), and decrement
it only after release_metapage() has reacquired the folio lock.  The
nonzero count makes metapage_release_folio() leave the struct metapage
allocated throughout the unlocked writeback interval.  Once
release_metapage() holds the folio lock again, it can drop the temporary
reference and safely finish using mp.

Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed.

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..d1962a44125a 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0

On Friday, 31 July 2026 13:00:06 CEST David Lee wrote:
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.
> 
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

1. weird advertisement at the end of the commit message which should either be 
   below the three dashes or written using the normal Tags 
   https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
   (and all these tag/format related sections below)

2. author didn't sign off the patch (see below)

3. odd unrelated Signed-off-by without any obvious connection to 
   the patch

   - I actually would guess that Kyle Zeng <kylebot@openai.com> is the author 
     and David Lee removed its authorship (From: ) before sending the patch.
     But in its current form, David is claiming to be the author. And even
     when it is the case, David must still add the the non-Author SoB at the
     end.

Regards,
	Sven