On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote:
> txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock
> info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can
> free that log during umount.
>
> No fix has been merged. The 2023 proposal was withdrawn by its author
> ("I think my fix method is not a good solution"), and the 2026 proposals
> for the same unmount race are unreviewed:
>
> https://lore.kernel.org/all/[email protected]/
> https://lore.kernel.org/all/[email protected]/
> https://lore.kernel.org/all/[email protected]/
The proposed patches from this year are certainly for a similar slab
use-after-free race, but I can't be sure it's exactly the same. So
please re-word this.
>
> The txEnd() sequence is unchanged in linux-next 20260727, and the
> use-after-free was reported again in June 2026 against 7.0-rc1, with the
> free stack in lmLogClose() via jfs_umount(); syzbot still lists it open:
>
> https://lore.kernel.org/all/[email protected]/
> https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
Again, may be a similar use-after-free, validating that it is exactly
the same one is time consuming.
> CONFIG_JFS_FS=n in both ktypes/standard and ktypes/preempt-rt in
> yocto-kernel-cache, and no fragment enables it.
Yes, but users may enable this, so it's not relevant to the analysis.
>
> CC: Paul Barker <[email protected]>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <[email protected]>
> ---
> v3:
> - correct the claim that only one fix was proposed and withdrawn:
> further fixes were posted in 2026 but none is merged
> - add the syzbot dashboard and the June 2026 report as evidence the
> race is still live in mainline
>
> v2:
> https://lore.kernel.org/openembedded-core/[email protected]/
>
> meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc
> b/meta/recipes-kernel/linux/cve-exclusion.inc
> index a909aef..c4a9dea 100644
> --- a/meta/recipes-kernel/linux/cve-exclusion.inc
> +++ b/meta/recipes-kernel/linux/cve-exclusion.inc
> @@ -237,3 +237,10 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from
> version 6.17"
> # https://www.willsroot.io/2022/12/entrybleed.html
> CVE_STATUS[CVE-2022-4543] = "unpatched: no upstream fix, KASLR is not \
> treated as a defence against local attackers"
> +
> +# JFS txEnd()/lmLogClose() use-after-free on unmount. No fix merged: the
> +# 2023 proposal was withdrawn, the 2026 proposals are unreviewed, and the
> +# racy code is unchanged; syzbot still reproduces it.
> +# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
> +CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix merged, the \
> +affected fs/jfs txEnd()/lmLogClose() unmount race is unchanged"
Recommended wording, links and include triage date:
# Triaged August 2026 - Originally proposed fix was withdrawn, similar
# slab-use-after-free appears to have been re-found by syzkaller in 2026.
# Unfixed in Debian, "needs evaluation" in Ubuntu.
#
https://lore.kernel.org/lkml/cajedcczmx02bfa22qeze8mu-idssdsy_oapt2ozcwo8o-8m...@mail.gmail.com/
# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
# https://security-tracker.debian.org/tracker/CVE-2023-3397
# https://ubuntu.com/security/CVE-2023-3397
CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn"
Best regards,
--
Paul Barker
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#243532):
https://lists.openembedded.org/g/openembedded-core/message/243532
Mute This Topic: https://lists.openembedded.org/mt/120714059/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
