On Sat, 25 Dec 2021 17:09:37 +0800, Zhang Yi wrote:

Our syzkaller report an use-after-free issue that accessing the freed
buffer_head on the writeback page in __ext4_journalled_writepage(). The
problem is that if there was a truncate racing with the data=journalled
writeback procedure, the writeback length could become zero and
bget_one() refuse to get buffer_head's refcount, then the truncate
procedure release buffer once we drop page lock, finally, the last
ext4_walk_page_buffers() trigger the use-after-free problem.

[...]

Nice catch.   Applied, thanks!

[1/1] ext4: fix an use-after-free issue about data=journal writeback mode
      commit: 856dd2096e2a01f6eb2c9d60f6e0cd587aa273a8

Best regards,
-- 
Theodore Ts'o [off-list ref]