Re: [Kernel Bug] KASAN: slab-use-after-free Read in filemap_free_folio

[Zhou, Yun]

Hi,

On 7/2/2026 3:59 PM, Longxing Li wrote:
> Dear maintainers,
>
> I'm trying to fix this issue. The bug analysis and patch fix are as follows.
> ========================================================
> Bug Summary
>
> ext4_add_complete_io() queues i_rsv_conversion_work without holding an
> extra inode reference. If the inode is unlinked & evicted before the
> delayed work runs, ext4_do_flush_completed_IO() accesses a freed inode —
> use-after-free.
>
> ========================================================
> Fix
>
> Take igrab(inode) when first queueing the work (detected via
> list_empty check), and iput() after processing in
> ext4_do_flush_completed_IO(). A per-inode bit (i_rsv_need_iput) tracks
> whether the reference was taken.
>
> Changes:
>    fs/ext4/ext4.h      - add i_rsv_need_iput bit to struct ext4_inode_info
>    fs/ext4/super.c     - init the bit to 0 in ext4_alloc_inode()
>    fs/ext4/page-io.c   - igrab() before queue_work, iput() after flush
>
> Full patch is as follows and is attached in the link.
Although I'm also a newbie, I should point out that the way you're 
sending the patch isn't quite right. You can just use the git send-email 
command directly.

For example:

git send-email --to tytso@xxxxxxx --to adilger.kernel@xxxxxxxxx --to 
libaokun@xxxxxxxxxxxxxxxxx --to jack@xxxxxxx --to ojaswin@xxxxxxxxxxxxx 
--to ritesh.list@xxxxxxxxx --to yi.zhang@xxxxxxxxxx --cc 
linux-ext4@xxxxxxxxxxxxxxx --cc linux-kernel@xxxxxxxxxxxxxxx bug-fix.patch

If you're unsure which maintainers, reviewers, or mailing lists to send 
a patch to, you can use the ./scripts/get_maintainer.pl script in the 
source directory to find out.

Before sending, it's best to do thorough functional and regression 
testing. You should also run the ./scripts/checkpatch.pl script to check 
for any formatting issues in your patch. It's a good idea to read the 
documentation in the Documentation/process/ directory first.

No rush, take your time. Feel free to ask me if you have any more questions.

Yun