Forwarded: Re: [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)
Author: suresh.k.chandrappa@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61438..e8ae90be089b 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1804,6 +1804,7 @@ static int lbmLogInit(struct jfs_log * log)
     * avoid deadlock here.
     */
    init_waitqueue_head(&log->free_wait);
+   init_waitqueue_head(&log->io_waitq);

    log->lbuf_free = NULL;

@@ -1855,6 +1856,8 @@ static void lbmLogShutdown(struct jfs_log * log)

    jfs_info("lbmLogShutdown: log:0x%p", log);

+   wait_event(log->io_waitq, !atomic_read(&log->io_inflight));
+
    lbuf = log->lbuf_free;
    while (lbuf) {
        struct lbuf *next = lbuf->l_freelist;
@@ -1976,6 +1979,8 @@ static int lbmRead(struct jfs_log * log, int pn,
struct lbuf ** bpp)

    bio->bi_end_io = lbmIODone;
    bio->bi_private = bp;
+
+   atomic_inc(&log->io_inflight);
    /*check if journaling to disk has been disabled*/
    if (log->no_integrity) {
        bio->bi_iter.bi_size = 0;
@@ -2123,6 +2128,7 @@ static void lbmStartIO(struct lbuf * bp)
    bio->bi_end_io = lbmIODone;
    bio->bi_private = bp;

+   atomic_inc(&log->io_inflight);
    /* check if journaling to disk has been disabled */
    if (log->no_integrity) {
        bio->bi_iter.bi_size = 0;
@@ -2186,6 +2192,8 @@ static void lbmIODone(struct bio *bio)

    bio_put(bio);

+   log = bp->l_log;
+
    /*
     *  pagein completion
     */
@@ -2214,7 +2222,6 @@ static void lbmIODone(struct bio *bio)
    INCREMENT(lmStat.pagedone);

    /* update committed lsn */
-   log = bp->l_log;
    log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;

    if (bp->l_flag & lbmDIRECT) {
@@ -2299,6 +2306,9 @@ static void lbmIODone(struct bio *bio)
 out:
    bp->l_flag |= lbmDONE;
    LCACHE_UNLOCK(flags);
+
+   if (atomic_dec_and_test(&log->io_inflight))
+       wake_up(&log->io_waitq);
 }

 int jfsIOWait(void *arg)
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 09e0ef6aecce..d8858448de6f 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -400,6 +400,9 @@ struct jfs_log {
    uuid_t uuid;        /* 16: 128-bit uuid of log device */

    int no_integrity;   /* 3: flag to disable journaling to disk */
+
+   atomic_t io_inflight;
+   wait_queue_head_t io_waitq;
 };

 /*
--
2.43.0