Re: [PATCH] gfs2: Fix use-after-free in gfs2_remove_from_journal()

[Andreas Gruenbacher]

Andy,

On Wed, Jun 17, 2026 at 12:52 PM Andrew Price <anprice@xxxxxxxxxx> wrote:
> On 17/06/2026 10:01, Hongling Zeng wrote:
> > The function calls brelse(bh) but then continues to access
> > the buffer head through bh->b_private, clear_buffer_dirty(),
> > and clear_buffer_uptodate().
> >
> > After brelse() decreases the reference count, the buffer head
> > may be freed, making the subsequent accesses use-after-free.
>
> When buffers are pinned their refcount is incremented and the brelse() here is only called for pinned buffers so I'm not convinced that there's a bug.

Not sure what you mean by that. The patch still only calls brelse() on
buffers it unpins, it only changes when it does it.

> Callers of gfs2_remove_from_journal() also use the bh afterwards so if there was a use-after-free this patch wouldn't fix it.

Do we have any callers that do that when they don't clearly still hold
a reference? I don't think so.

In any case, if there are any callers that don't certainly hold an
extra reference, we need to be careful in gfs2_remove_from_journal().
This patch achieves that, so I'm inclined to merge it.

Thanks,
Andreas