From:   "Theodore Ts'o" <tytso@mit.edu>
To:     linux-ext4@vger.kernel.org, Zhang Yi <yi.zhang@huawei.com>
Cc:     "Theodore Ts'o" <tytso@mit.edu>, jack@suse.cz,
        adilger.kernel@dilger.ca, yukuai3@huawei.com
Subject: Re: [PATCH] ext4: fix an use-after-free issue about data=journal writeback mode
Date:   Mon, 27 Dec 2021 10:16:24 -0500
Message-Id: <164061813992.3186289.16531799470914194648.b4-ty@mit.edu>
In-Reply-To: <20211225090937.712867-1-yi.zhang@huawei.com>
References: <20211225090937.712867-1-yi.zhang@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Sat, 25 Dec 2021 17:09:37 +0800, Zhang Yi wrote:
> Our syzkaller report an use-after-free issue that accessing the freed
> buffer_head on the writeback page in __ext4_journalled_writepage(). The
> problem is that if there was a truncate racing with the data=journalled
> writeback procedure, the writeback length could become zero and
> bget_one() refuse to get buffer_head's refcount, then the truncate
> procedure release buffer once we drop page lock, finally, the last
> ext4_walk_page_buffers() trigger the use-after-free problem.
> 
> [...]

Nice catch.   Applied, thanks!

[1/1] ext4: fix an use-after-free issue about data=journal writeback mode
      commit: 856dd2096e2a01f6eb2c9d60f6e0cd587aa273a8

Best regards,
-- 
Theodore Ts'o <tytso@mit.edu>