[PATCH] jfs: pin metapage during synchronous writeback

[David Lee]

release_metapage() decrements mp->count from one to zero but keeps the
struct metapage pointer in its local variable mp.  For synchronous
writeback, release_metapage() calls metapage_write_one(), which in turn
calls metapage_write_folio().  metapage_write_folio() clears
META_dirty, submits the I/O, and this unlocks the folio while synchronous
I/O is in progress.

After writeback completes, kswapd can acquire the folio lock before
release_metapage().  metapage_release_folio() then sees mp->count == 0
and META_dirty clear, removes mp from the folio, and frees the struct
metapage.  release_metapage() subsequently reacquires the folio lock
and passes its now-dangling mp pointer to drop_metapage(), which does
an use-after-free read of mp->count.

Increment mp->count before calling metapage_write_one(), and decrement
it only after release_metapage() has reacquired the folio lock.  The
nonzero count makes metapage_release_folio() leave the struct metapage
allocated throughout the unlocked writeback interval.  Once
release_metapage() holds the folio lock again, it can drop the temporary
reference and safely finish using mp.

Bug found and triaged by OpenAI Security Research and 
validated by Trail of Bits.

Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed.

 fs/jfs/jfs_metapage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 41fe12e641ce..d1962a44125a 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -882,9 +882,12 @@ void release_metapage(struct metapage * mp)
 		folio_mark_dirty(folio);
 		if (test_bit(META_sync, &mp->flag)) {
 			clear_bit(META_sync, &mp->flag);
+			/* Pin mp while metapage_write_one() drops the folio lock. */
+			mp->count++;
 			if (metapage_write_one(folio))
 				jfs_error(mp->sb, "metapage_write_one() failed\n");
 			folio_lock(folio);
+			mp->count--;
 		}
 	} else if (mp->lsn)	/* discard_metapage doesn't remove it */
 		remove_from_logsync(mp);
-- 
2.53.0