[Jfs-discussion] [PATCH] jfs: fix kernel BUG in jfs_evict_inode

[Junjie C. <jun...@in...>]

syzbot reported a kernel BUG in jfs_evict_inode() triggered by the
following check:

    BUG_ON(!list_empty(&JFS_IP(inode)->anon_inode_list));

When an inode reaches jfs_evict_inode() with outstanding anonymous
transactions, the filesystem state is already inconsistent.  However,
crashing the whole kernel in this situation is too heavy-handed and
can be triggered by a corrupted or fuzzed filesystem image.

The transaction manager uses anon_inode_list to track inodes that
have anonymous tlocks attached.  Leaving an evicted inode on this
list is wrong as it leaves a dangling pointer behind and risks a
use-after-free when the list is walked later.

Instead of panicking, log the condition and remove the inode from
anon_inode_list under TXN_LOCK using a new helper, jfs_free_anon_inode().
This keeps the internal list consistent while avoiding a user-triggerable
kernel BUG.

Reported-by: syz...@sy...
Closes: https://syzkaller.appspot.com/bug?extid=9c0c58ea2e4887ab502e
Tested-by: syz...@sy...
Signed-off-by: Junjie Cao <jun...@in...>
---
 fs/jfs/inode.c      |  2 +-
 fs/jfs/jfs_txnmgr.c | 14 ++++++++++++++
 fs/jfs/jfs_txnmgr.h |  1 +
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 4709762713ef..88c046c3c3e3 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -172,7 +172,7 @@ void jfs_evict_inode(struct inode *inode)
 	clear_inode(inode);
 	dquot_drop(inode);
 
-	BUG_ON(!list_empty(&ji->anon_inode_list));
+	jfs_free_anon_inode(inode);
 
 	spin_lock_irq(&ji->ag_lock);
 	if (ji->active_ag != -1) {
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c16578af3a77..00e69f3ab22d 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -3018,3 +3018,17 @@ int jfs_txstats_proc_show(struct seq_file *m, void *v)
 	return 0;
 }
 #endif
+
+void jfs_free_anon_inode(struct inode *inode)
+{
+	struct jfs_inode_info *ji = JFS_IP(inode);
+
+	TXN_LOCK();
+	if (!list_empty(&ji->anon_inode_list)) {
+		jfs_err("inode %lu evicted with anonymous tlocks",
+			inode->i_ino);
+		list_del_init(&ji->anon_inode_list);
+	}
+	TXN_UNLOCK();
+}
+
diff --git a/fs/jfs/jfs_txnmgr.h b/fs/jfs/jfs_txnmgr.h
index ba71eb5ced56..64d917ccc4b0 100644
--- a/fs/jfs/jfs_txnmgr.h
+++ b/fs/jfs/jfs_txnmgr.h
@@ -295,4 +295,5 @@ extern void txResume(struct super_block *);
 extern void txLazyUnlock(struct tblock *);
 extern int jfs_lazycommit(void *);
 extern int jfs_sync(void *);
+extern void jfs_free_anon_inode(struct inode *);
 #endif				/* _H_JFS_TXNMGR */
-- 
2.43.0