From: Kyle Zeng <kylebot@openai.com>
release_metapage() decrements mp->count to zero before it starts a
synchronous write. metapage_write_one() drops the folio lock while it
waits for writeback, but release_metapage() retains mp and dereferences
it after taking the folio lock again.
Once writeback clears META_dirty and ends, reclaim can lock the folio
first. metapage_release_folio() then observes a zero count and frees mp,
leaving release_metapage() with a dangling pointer.
Increment mp->count across the unlocked interval. This makes
metapage_release_folio() reject the folio until release_metapage()
holds the folio lock again and can safely drop the temporary reference.
Fixes: 7fab479bebb9 ("[PATCH] JFS: Support page sizes greater than 4K")
Reported-by: syzbot+f1521383cec5f7baaa94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1521383cec5f7baaa94
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
The syzkaller issue seems to be the same, although the syzbot repro
does not trigger KASAN on my side. Trail of Bits has another reproducer
for this bug that triggers a KASAN use-after-free and can it share if needed
fs/jfs/jfs_metapage.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e..d1962a4 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
folio_mark_dirty(folio);
if (test_bit(META_sync, &mp->flag)) {
clear_bit(META_sync, &mp->flag);
+ /* Pin mp while metapage_write_one() drops the folio lock. */
+ mp->count++;
if (metapage_write_one(folio))
jfs_error(mp->sb, "metapage_write_one() failed\n");
folio_lock(folio);
+ mp->count--;
}
} else if (mp->lsn) /* discard_metapage doesn't remove it */
remove_from_logsync(mp);
--
2.53.0