Re: [BUG] jfs: KASAN use-after-free in diRead() panics the kernel on mount

[Guikun Yang]

Hi Dave,

I need to retract my report from earlier today: it is a duplicate of
1sh1ro's report from October 12 and their follow-up with the reproducer
and root cause.

I did a background search before sending, but my keyword search missed
the original report because its subject line does not mention diRead.
That is my mistake, and I should have found it.  1sh1ro's analysis is
also more complete than mine: they identified the exact window
(jfs_mount_rw(sb, remount=1) freeing sbi->bmap between dbUnmount() and
dbMount()), the exact access (BLKTOAG() reading bmap->db_agl2size), and
they have a working reproducer.  My report only had the KASAN trace from
a fuzzing run, which covers the same race at the same offset.

Please treat 1sh1ro's thread as the authoritative report and disregard
mine.  Sorry for the noise.

Best,
Guikun Yang