Re: [Kernel Bug] KASAN: slab-use-after-free Read in filemap_free_folio

["Zhou, Yun" <yun.zhou@windriver.com>]

Hi,

On 7/2/2026 3:59 PM, Longxing Li wrote:
> 
> Dear maintainers,
> 
> I'm trying to fix this issue. The bug analysis and patch fix are as follows.
> ========================================================
> Bug Summary
> 
> ext4_add_complete_io() queues i_rsv_conversion_work without holding an
> extra inode reference. If the inode is unlinked & evicted before the
> delayed work runs, ext4_do_flush_completed_IO() accesses a freed inode —
> use-after-free.
> 
> ========================================================
> Fix
> 
> Take igrab(inode) when first queueing the work (detected via
> list_empty check), and iput() after processing in
> ext4_do_flush_completed_IO(). A per-inode bit (i_rsv_need_iput) tracks
> whether the reference was taken.
> 
> Changes:
>    fs/ext4/ext4.h      - add i_rsv_need_iput bit to struct ext4_inode_info
>    fs/ext4/super.c     - init the bit to 0 in ext4_alloc_inode()
>    fs/ext4/page-io.c   - igrab() before queue_work, iput() after flush
> 
> Full patch is as follows and is attached in the link.
> 
Although I'm also a newbie, I should point out that the way you're 
sending the patch isn't quite right. You can just use the git send-email 
command directly.

For example:

git send-email --to tytso@mit.edu --to adilger.kernel@dilger.ca --to 
libaokun@linux.alibaba.com --to jack@suse.cz --to ojaswin@linux.ibm.com 
--to ritesh.list@gmail.com --to yi.zhang@huawei.com --cc 
linux-ext4@vger.kernel.org --cc linux-kernel@vger.kernel.org bug-fix.patch

If you're unsure which maintainers, reviewers, or mailing lists to send 
a patch to, you can use the ./scripts/get_maintainer.pl script in the 
source directory to find out.

Before sending, it's best to do thorough functional and regression 
testing. You should also run the ./scripts/checkpatch.pl script to check 
for any formatting issues in your patch. It's a good idea to read the 
documentation in the Documentation/process/ directory first.

No rush, take your time. Feel free to ask me if you have any more questions.

Yun