release_metapage() decrements mp->count to zero before it starts a
synchronous write. metapage_write_one() drops the folio lock while it
waits for writeback, but release_metapage() retains mp and dereferences
it after taking the folio lock again.

Once writeback clears META_dirty and ends, reclaim can lock the folio
first. metapage_release_folio() then observes a zero count and frees mp,
leaving release_metapage() with a dangling pointer.

Add a separate writeback counter that metapage release and reclaim both
honor while synchronous writeback has dropped the folio lock. Keep it
separate from mp->count so concurrent writers can still reach the final
release path and propagate META_dirty to the page cache.

Fixes: 7fab479bebb9 ("[PATCH] JFS: Support page sizes greater than 4K")
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: syzbot+f1521383cec5f7baaa94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1521383cec5f7baaa94
Assisted-by: Codex:gpt-6
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
 fs/jfs/jfs_metapage.c | 9 ++++++---
 fs/jfs/jfs_metapage.h | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

v2: Following the Sashiko review at 
https://sashiko.dev/#/patchset/20260922110754.1804555-1-bruno.produit%40trailofbits.com,
use a separate writeback counter to preserve concurrent dirty writes.

The syzkaller issue has the same crash and root cause, although its public
reproducer did not trigger KASAN in local runs. A separate reproducer
reliably triggers the KASAN use-after-free under reclaim pressure.

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..1c388eb4af2b 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -269,6 +269,7 @@ static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
 		mp->data = NULL;
 		mp->clsn = 0;
 		mp->log = NULL;
+		mp->writeback_count = 0;
 		init_waitqueue_head(&mp->wait);
 		INIT_LIST_HEAD(&mp->synclist);
 	}
@@ -309,8 +310,8 @@ void metapage_exit(void)
 
 static inline void drop_metapage(struct folio *folio, struct metapage *mp)
 {
-	if (mp->count || mp->nohomeok || test_bit(META_dirty, &mp->flag) ||
-	    test_bit(META_io, &mp->flag))
+	if (mp->count || mp->nohomeok || mp->writeback_count ||
+	    test_bit(META_dirty, &mp->flag) || test_bit(META_io, &mp->flag))
 		return;
 	remove_metapage(folio, mp);
 	INCREMENT(mpStat.pagefree);
@@ -623,7 +624,7 @@ static bool metapage_release_folio(struct folio *folio, gfp_t gfp_mask)
 			continue;
 
 		jfs_info("metapage_release_folio: mp = 0x%p", mp);
-		if (mp->count || mp->nohomeok ||
+		if (mp->count || mp->nohomeok || mp->writeback_count ||
 		    test_bit(META_dirty, &mp->flag)) {
 			jfs_info("count = %ld, nohomeok = %d", mp->count,
 				 mp->nohomeok);
@@ -882,9 +883,11 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			mp->writeback_count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->writeback_count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
diff --git a/fs/jfs/jfs_metapage.h b/fs/jfs/jfs_metapage.h
index 2e5015c2705b..12368314b2da 100644
--- a/fs/jfs/jfs_metapage.h
+++ b/fs/jfs/jfs_metapage.h
@@ -31,6 +31,7 @@ struct metapage {
 	/* Journal management */
 	int clsn;
 	int nohomeok;
+	unsigned int writeback_count; /* Synchronous writeback users */
 	struct jfs_log *log;
 };
 
-- 
2.53.0