Forwarded: Re: [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)

syzbot
2026-04-20T04:08:35Z

From 56a838ee6e3c6834a7e7705472144b1c84a4d8f8 Mon Sep 17 00:00:00 2001
From: Suresh K C <suresh.k.chandrappa@gmail.com>
Date: Sat, 18 Apr 2026 10:14:20 +0530
Subject: [PATCH] jfs: fix use-after-free in lbmIODone

Add an atomic io_inflight counter and a wait queue (io_waitq) to
struct jfs_log to track in-flight I/O operations. This ensures that
lbmLogShutdown() waits for all pending log I/O to complete before
freeing log buffers, preventing a use-after-free race condition where
the loop device workqueue could still be reading from log buffer pages
that have already been freed.

The io_inflight counter is incremented in lbmRead() and lbmStartIO()
before submitting bios, and decremented in lbmIODone() after I/O
completion processing is finished.

Reported-by: syzbot+6cc93ec9a4035badb85f@syzkaller.appspotmail.com
Signed-off-by: Suresh K C <suresh.k.chandrappa@gmail.com>
---
fs/jfs/jfs_logmgr.c | 12 +++++++++++-
fs/jfs/jfs_logmgr.h | 3 +++
2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61438..e8ae90be089b 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1804,6 +1804,7 @@ static int lbmLogInit(struct jfs_log * log)
* avoid deadlock here.
*/
init_waitqueue_head(&log->free_wait);
+ init_waitqueue_head(&log->io_waitq);

log->lbuf_free = NULL;

@@ -1855,6 +1856,8 @@ static void lbmLogShutdown(struct jfs_log * log)

jfs_info("lbmLogShutdown: log:0x%p", log);

+ wait_event(log->io_waitq, !atomic_read(&log->io_inflight));
+
lbuf = log->lbuf_free;
while (lbuf) {
struct lbuf *next = lbuf->l_freelist;
@@ -1976,6 +1979,8 @@ static int lbmRead(struct jfs_log * log, int pn,
struct lbuf ** bpp)

bio->bi_end_io = lbmIODone;
bio->bi_private = bp;
+
+ atomic_inc(&log->io_inflight);
/*check if journaling to disk has been disabled*/
if (log->no_integrity) {
bio->bi_iter.bi_size = 0;
@@ -2123,6 +2128,7 @@ static void lbmStartIO(struct lbuf * bp)
bio->bi_end_io = lbmIODone;
bio->bi_private = bp;

+ atomic_inc(&log->io_inflight);
/* check if journaling to disk has been disabled */
if (log->no_integrity) {
bio->bi_iter.bi_size = 0;
@@ -2186,6 +2192,8 @@ static void lbmIODone(struct bio *bio)

bio_put(bio);

+ log = bp->l_log;
+
/*
* pagein completion
*/
@@ -2214,7 +2222,6 @@ static void lbmIODone(struct bio *bio)
INCREMENT(lmStat.pagedone);

/* update committed lsn */
- log = bp->l_log;
log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;

if (bp->l_flag & lbmDIRECT) {
@@ -2299,6 +2306,9 @@ static void lbmIODone(struct bio *bio)
out:
bp->l_flag |= lbmDONE;
LCACHE_UNLOCK(flags);
+
+ if (atomic_dec_and_test(&log->io_inflight))
+ wake_up(&log->io_waitq);
}

int jfsIOWait(void *arg)
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 09e0ef6aecce..d8858448de6f 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -400,6 +400,9 @@ struct jfs_log {
uuid_t uuid; /* 16: 128-bit uuid of log device */

int no_integrity; /* 3: flag to disable journaling to disk */
+
+ atomic_t io_inflight;
+ wait_queue_head_t io_waitq;
};

/*
--
2.43.0