Re: [PATCH] gfs2: Fix use-after-free in gfs2_remove_from_journal()

[Andreas Gruenbacher]

On Wed, Jun 17, 2026 at 11:02 AM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
> The function calls brelse(bh) but then continues to access
> the buffer head through bh->b_private, clear_buffer_dirty(),
> and clear_buffer_uptodate().
>
> After brelse() decreases the reference count, the buffer head
> may be freed, making the subsequent accesses use-after-free.
>
> Fix by moving the brelse(bh) call to the end of the function,
> after all accesses to bh have been completed.
>
> Fixes: e93b100931a4 ("GFS2: Fix slab memory leak in gfs2_bufdata")

That commit by Bob looks suspicious: bh->b_private data is usually
freed by the ->release_folio address space operation, so there should
be no need for freeing bufdata objects here. (That has little to do
with your commit, of course.)

> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> ---
>  fs/gfs2/log.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
> index 78bba8cc10b8..a92c84146de9 100644
> --- a/fs/gfs2/log.c
> +++ b/fs/gfs2/log.c
> @@ -1038,7 +1038,6 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta)
>                         set_bit(TR_TOUCHED, &tr->tr_flags);
>                 }
>                 was_pinned = 1;
> -               brelse(bh);
>         }
>         if (bd) {
>                 if (bd->bd_tr) {
> @@ -1056,6 +1055,8 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta)
>         }
>         clear_buffer_dirty(bh);
>         clear_buffer_uptodate(bh);
> +       if (was_pinned)
> +               brelse(bh);
>  }
>
>  /**
> --
> 2.25.1
>