Re: [PATCH] gfs2: Fix use-after-free in gfs2_remove_from_journal()

[Andrew Price]

On 24/08/2026 15:20, Andreas Gruenbacher wrote:
> Andy,
> 
> On Wed, Jun 17, 2026 at 12:52 PM Andrew Price <anprice@xxxxxxxxxx> wrote:
>> On 17/06/2026 10:01, Hongling Zeng wrote:
>>> The function calls brelse(bh) but then continues to access
>>> the buffer head through bh->b_private, clear_buffer_dirty(),
>>> and clear_buffer_uptodate().
>>>
>>> After brelse() decreases the reference count, the buffer head
>>> may be freed, making the subsequent accesses use-after-free.
>>
>> When buffers are pinned their refcount is incremented and the brelse() here is only called for pinned buffers so I'm not convinced that there's a bug.
> 
> Not sure what you mean by that. The patch still only calls brelse() on
> buffers it unpins, it only changes when it does it.

The context is not fresh in my mind but I suppose was trying to locate the UAF that the patch reportedly fixed and I couldn't find one.

>> Callers of gfs2_remove_from_journal() also use the bh afterwards so if there was a use-after-free this patch wouldn't fix it.
> 
> Do we have any callers that do that when they don't clearly still hold
> a reference? I don't think so.
> 
> In any case, if there are any callers that don't certainly hold an
> extra reference, we need to be careful in gfs2_remove_from_journal().
> This patch achieves that, so I'm inclined to merge it.
No objections here. I'd like the commit description to be clear about whether it's fixing a bug or just cleaning up a static analysis warning.

Andy