)]}'
{
  "commit": "cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42",
  "tree": "386792a20275c77eba70f4386fbab57b540d41e5",
  "parents": [
    "121f787e740d67320a424432b6e1d0d4cec467ae"
  ],
  "author": {
    "name": "Chao Yu",
    "email": "chao@kernel.org",
    "time": "Tue Feb 17 10:19:55 2026 -0500"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Thu Feb 19 16:29:56 2026 +0100"
  },
  "message": "f2fs: fix to avoid UAF in f2fs_write_end_io()\n\n[ Upstream commit ce2739e482bce8d2c014d76c4531c877f382aa54 ]\n\nAs syzbot reported an use-after-free issue in f2fs_write_end_io().\n\nIt is caused by below race condition:\n\nloop device\t\t\t\tumount\n- worker_thread\n - loop_process_work\n  - do_req_filebacked\n   - lo_rw_aio\n    - lo_rw_aio_complete\n     - blk_mq_end_request\n      - blk_update_request\n       - f2fs_write_end_io\n        - dec_page_count\n        - folio_end_writeback\n\t\t\t\t\t- kill_f2fs_super\n\t\t\t\t\t - kill_block_super\n\t\t\t\t\t  - f2fs_put_super\n\t\t\t\t\t : free(sbi)\n       : get_pages(, F2FS_WB_CP_DATA)\n         accessed sbi which is freed\n\nIn kill_f2fs_super(), we will drop all page caches of f2fs inodes before\ncall free(sbi), it guarantee that all folios should end its writeback, so\nit should be safe to access sbi before last folio_end_writeback().\n\nLet\u0027s relocate ckpt thread wakeup flow before folio_end_writeback() to\nresolve this issue.\n\nCc: stable@kernel.org\nFixes: e234088758fc (\"f2fs: avoid wait if IO end up when do_checkpoint for better performance\")\nReported-by: syzbot+b4444e3c972a7a124187@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db4444e3c972a7a124187\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n[ folio \u003d\u003e page ]\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0c4c8a35774260ee93002c354b27ec9217cf0f1f",
      "old_mode": 33188,
      "old_path": "fs/f2fs/data.c",
      "new_id": "7bd6f9f108ec43ed8ffe66d6e250c1de02ce64d9",
      "new_mode": 33188,
      "new_path": "fs/f2fs/data.c"
    }
  ]
}