Forwarded: Re: [syzbot] KASAN: slab-use-after-free Read in lbmIODone

[syzbot <syzbot+ecf51a7ccb6b1394e90c@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] KASAN: slab-use-after-free Read in lbmIODone
Author: tristmd@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 9fd2228641cd56d9e735211ce0d2decfd03aaaa9 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:16 +0000
Subject: [PATCH] jfs: fix use-after-free in lbmIODone by waiting for in-flight
 I/O
lbmLogShutdown() frees all log buffer heads without waiting for
outstanding block I/O completions. When a write bio submitted via
lbmStartIO() completes after the buffers are freed, lbmIODone()
dereferences the freed struct lbuf via bio->bi_private.
Add an atomic io_count and wait_queue_head_t to struct jfs_log.
Increment before submit_bio(), decrement after processing in
lbmIODone(), and wait in lbmLogShutdown() for io_count == 0
before freeing.
Reported-by: syzbot+ecf51a7ccb6b1394e90c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ecf51a7ccb6b1394e90c
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/jfs/jfs_logmgr.c | 15 ++++++++++++++-
 fs/jfs/jfs_logmgr.h |  3 +++
 2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e..e309e1b 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1805,6 +1805,9 @@ static int lbmLogInit(struct jfs_log * log)
 	 */
 	init_waitqueue_head(&log->free_wait);
 
+	atomic_set(&log->io_count, 0);
+	init_waitqueue_head(&log->io_wait);
+
 	log->lbuf_free = NULL;
 
 	for (i = 0; i < LOGPAGES;) {
@@ -1855,6 +1858,8 @@ static void lbmLogShutdown(struct jfs_log * log)
 
 	jfs_info("lbmLogShutdown: log:0x%p", log);
 
+	wait_event(log->io_wait, atomic_read(&log->io_count) == 0);
+
 	lbuf = log->lbuf_free;
 	while (lbuf) {
 		struct lbuf *next = lbuf->l_freelist;
@@ -2128,6 +2133,7 @@ static void lbmStartIO(struct lbuf * bp)
 		bio->bi_iter.bi_size = 0;
 		lbmIODone(bio);
 	} else {
+		atomic_inc(&log->io_count);
 		submit_bio(bio);
 		INCREMENT(lmStat.submitted);
 	}
@@ -2170,12 +2176,16 @@ static void lbmIODone(struct bio *bio)
 	struct lbuf *nextbp, *tail;
 	struct jfs_log *log;
 	unsigned long flags;
+	int is_write;
 
 	/*
 	 * get back jfs buffer bound to the i/o buffer
 	 */
 	jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);
 
+	log = bp->l_log;
+	is_write = !(bp->l_flag & lbmREAD);
+
 	LCACHE_LOCK(flags);		/* disable+lock */
 
 	if (bio->bi_status) {
@@ -2214,7 +2224,6 @@ static void lbmIODone(struct bio *bio)
 	INCREMENT(lmStat.pagedone);
 
 	/* update committed lsn */
-	log = bp->l_log;
 	log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;
 
 	if (bp->l_flag & lbmDIRECT) {
@@ -2299,6 +2308,10 @@ static void lbmIODone(struct bio *bio)
 out:
 	bp->l_flag |= lbmDONE;
 	LCACHE_UNLOCK(flags);
+
+	if (is_write && !log->no_integrity)
+		if (atomic_dec_and_test(&log->io_count))
+			wake_up(&log->io_wait);
 }
 
 int jfsIOWait(void *arg)
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 09e0ef6..6fa7d9f 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -400,6 +400,9 @@ struct jfs_log {
 	uuid_t uuid;		/* 16: 128-bit uuid of log device */
 
 	int no_integrity;	/* 3: flag to disable journaling to disk */
+
+	atomic_t io_count;		/* outstanding I/O count */
+	wait_queue_head_t io_wait;	/* wait for all I/O to complete */
 };
 
 /*
-- 
2.47.3