buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Joseph Qi 3 weeks, 3 days ago

Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
__bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
5febcba29792 ("jbd2: point the shadow buffer at the frozen data
directly") made them point b_data at the kmalloced frozen data rather
than a folio.  Submitting such a buffer during journal commit oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:__bh_submit.constprop.0+0x87/0x120
  Call Trace:
   jbd2_journal_commit_transaction+0x932/0x1b10
   kjournald2+0xb2/0x250

Hit by the ocfs2-testsuite fill_verify_holes test running with
data=writeback.

Dropbehind only applies to buffers backed by a folio, so skip the check
when b_folio is NULL.

Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
---
 fs/buffer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/buffer.c b/fs/buffer.c
index 427d8a817cd5..f46fa6413032 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
 
 	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
 
-	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
+	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
+	    op_is_write(opf))
 		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
 
 	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
-- 
2.39.3

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by André Draszik 1 week, 4 days ago

On Wed, 2026-09-02 at 09:33 +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
> 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Tested-by: André Draszik <andre.draszik@linaro.org> # Pixel 6

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Konrad Dybcio 2 weeks, 2 days ago

On 9/2/26 3:33 AM, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
> 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);


-next has been broken for a week+ already, please pick this up..

Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # multiple QC boards

Konrad

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Jan Kara 2 weeks, 1 day ago

On Thu 10-09-26 10:08:55, Konrad Dybcio wrote:
> On 9/2/26 3:33 AM, Joseph Qi wrote:
> > Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> > writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> > __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> > 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> > directly") made them point b_data at the kmalloced frozen data rather
> > than a folio.  Submitting such a buffer during journal commit oopses:
> > 
> >   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
> >   Call Trace:
> >    jbd2_journal_commit_transaction+0x932/0x1b10
> >    kjournald2+0xb2/0x250
> > 
> > Hit by the ocfs2-testsuite fill_verify_holes test running with
> > data=writeback.
> > 
> > Dropbehind only applies to buffers backed by a folio, so skip the check
> > when b_folio is NULL.
> > 
> > Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> > Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> > Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> > Reviewed-by: Jan Kara <jack@suse.cz>
> > Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> > ---
> >  fs/buffer.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/buffer.c b/fs/buffer.c
> > index 427d8a817cd5..f46fa6413032 100644
> > --- a/fs/buffer.c
> > +++ b/fs/buffer.c
> > @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
> >  
> >  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
> >  
> > -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> > +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> > +	    op_is_write(opf))
> >  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
> 
> 
> -next has been broken for a week+ already, please pick this up..

Christian has pushed out a branch with the fixed version of the code today
so hopefully it should get fixed in linux-next soon.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Chris Paterson 2 weeks, 4 days ago

On Wed, 2 Sep 2026 09:33:57 +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
>
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
>
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>

This patch fixes the same error we've been seeing on various Renesas RZ
platforms. Tested on RZ/V2H EVK, RZ/V2N EVK and SMARC RZ/G3E EVK.

Tested-by: Chris Paterson <chris.paterson2@renesas.com>

Thanks!
Chris

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Dang Huynh 2 weeks, 4 days ago

Hi Joseph Qi,

I have the same issue on my Orange Pi 5 (next-20260904) and this patch
fixed it. Been running for at least an hour without any issues.

Tested-by: Dang Huynh <dang.huynh@mainlining.org> # Orange Pi 5

On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
> 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Gong Shuai 2 weeks, 6 days ago

> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
>
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
>
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---


Hi Joseph,

Thanks for the fix.

On the OrangePi RV2 single-board (SpacemiT K1, riscv64) I hit the NULL
pointer dereference while testing other patches on top of linux-next
(next-20260904).

The jbd2/mmcblk1p3-N commit thread crashed in __bh_submit() when
submitting a journal shadow buffer whose b_folio is NULL. On this
board the crash reproduced reliably, roughly 3 minutes after boot,
under normal filesystem activity on the ext4 rootfs (buildroot-based
minimal userspace).

After applying this fix, the same kernel/board combination has been
running stably for several hours with no errors.

Tested-by: Gong Shuai <gsh517025@gmail.com> # OrangePi-RV2

Best regards,
Shuai


>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Greg Ociepka 3 weeks, 1 day ago

On Wed, 2 Sep 2026 09:33:57 +0800, Joseph Qi wrote:
> Since commit 8deae2284976 ("buffer: allow a buffer_head to point at
> memory outside the page cache"), bh->b_folio may be NULL.

We hit the same NULL dereference independently on real hardware, and
it is nastier than a fuzzer-only finding: on an ext4 root filesystem
every boot of next-20260831 (and every later tag up to next-20260903)
dies about two minutes in. jbd2's shadow buffers have no b_folio by
design, so the first journal commit after mount oopses in
__bh_submit(), kjournald2 is killed by make_task_dead() and every
subsequent metadata write blocks forever - journald, the flush workers
and eventually all of userspace wedge in uninterruptible sleep with no
block-layer errors reported. After an unclean shutdown the crash moves
into early boot (journal recovery commits immediately), which makes
the machine effectively unbootable until a different kernel is chosen.

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  CPU: 0 UID: 0 PID: 357 Comm: jbd2/nvme0n1p18 Tainted: G        W  7.3.0-rc1-next-20260831
  pc : __bh_submit+0xa8/0x210
  Call trace:
   __bh_submit+0xa8/0x210 (P)
   bh_submit+0x24/0x38
   jbd2_journal_commit_transaction+0xb80/0x1ce8
   kjournald2+0xb8/0x238

With this exact change applied on top of next-20260831 the same
machine (ASUS Zenbook A16 UX3607OA, Snapdragon X2 Elite, arm64) boots
reliably and has been running normally for 11+ hours.

Tested-by: Greg Ociepka <greg@ferrisoft.com>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Yalagada Pavan Kumar 3 weeks, 2 days ago

On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
Hi,

I was working on a fix for this syzbot report [1] and didn't realize that you were
already working on it. I noticed your patch on the mailing list, so i won't
send a duplicate patch.
 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")

Could you please add the Reported-by: and Closes: tags from the syzbot report
to your patch? This will help syzbot associate the patch with the reported
issue and track the fix.

[1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f

Thank you,
Pavan

> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Joseph Qi 3 weeks, 2 days ago


On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
>> directly") made them point b_data at the kmalloced frozen data rather
>> than a folio.  Submitting such a buffer during journal commit oopses:
>>
>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>>   Call Trace:
>>    jbd2_journal_commit_transaction+0x932/0x1b10
>>    kjournald2+0xb2/0x250
>>
>> Hit by the ocfs2-testsuite fill_verify_holes test running with
>> data=writeback.
>>
>> Dropbehind only applies to buffers backed by a folio, so skip the check
>> when b_folio is NULL.
>>
> Hi,
> 
> I was working on a fix for this syzbot report [1] and didn't realize that you were
> already working on it. I noticed your patch on the mailing list, so i won't
> send a duplicate patch.
>  
>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> 
> Could you please add the Reported-by: and Closes: tags from the syzbot report
> to your patch? This will help syzbot associate the patch with the reported
> issue and track the fix.
> 
> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> 
Hi Christian,
Could you please address the above when apply the patch? Or should I
resend the patch with them?

Thanks,
Joseph

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Christian Brauner 3 weeks, 1 day ago

On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
> 
> 
> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> > On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> >> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> >> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> >> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> >> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> >> directly") made them point b_data at the kmalloced frozen data rather
> >> than a folio.  Submitting such a buffer during journal commit oopses:
> >>
> >>   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
> >>   Call Trace:
> >>    jbd2_journal_commit_transaction+0x932/0x1b10
> >>    kjournald2+0xb2/0x250
> >>
> >> Hit by the ocfs2-testsuite fill_verify_holes test running with
> >> data=writeback.
> >>
> >> Dropbehind only applies to buffers backed by a folio, so skip the check
> >> when b_folio is NULL.
> >>
> > Hi,
> > 
> > I was working on a fix for this syzbot report [1] and didn't realize that you were
> > already working on it. I noticed your patch on the mailing list, so i won't
> > send a duplicate patch.
> >  
> >> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> > 
> > Could you please add the Reported-by: and Closes: tags from the syzbot report
> > to your patch? This will help syzbot associate the patch with the reported
> > issue and track the fix.
> > 
> > [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> > 
> Hi Christian,
> Could you please address the above when apply the patch? Or should I
> resend the patch with them?

I'll do it. Thanks!

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Thorsten Leemhuis 1 week, 1 day ago

On 9/4/26 12:35, Christian Brauner wrote:
> On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
>> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
>>> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
>>>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
>>>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
>>>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
>>>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
>>>> directly") made them point b_data at the kmalloced frozen data rather
>>>> than a folio.  Submitting such a buffer during journal commit oopses:
>>>>
>>>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>>> [...]
>>> I was working on a fix for this syzbot report [1] and didn't realize that you were
>>> already working on it. I noticed your patch on the mailing list, so i won't
>>> send a duplicate patch.
>>>  
>>>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
>>>
>>> Could you please add the Reported-by: and Closes: tags from the syzbot report
>>> to your patch? This will help syzbot associate the patch with the reported
>>> issue and track the fix.
>>>
>>> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
>>>
>> Could you please address the above when apply the patch? Or should I
>> resend the patch with them?
> 
> I'll do it. Thanks!
Christian, just wondering, did this fix maybe fall through the cracks?
This got on my radar because there were a few other reports about this
regression since then -- and I can't see this or some other fix like
this in -next.

At the same time it feels a lot like I'm missing something -- or like
some deeper problem with all of this turned up meanwhile, which required
more changes that people are still working on. If it's something like
that and everything is on track, feel free to just ignore this message.

Ciao, Thorsten

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

Posted by Jan Kara 4 days ago

On Fri 18-09-26 08:53:38, Thorsten Leemhuis wrote:
> On 9/4/26 12:35, Christian Brauner wrote:
> > On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
> >> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> >>> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> >>>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> >>>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> >>>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> >>>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> >>>> directly") made them point b_data at the kmalloced frozen data rather
> >>>> than a folio.  Submitting such a buffer during journal commit oopses:
> >>>>
> >>>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >>> [...]
> >>> I was working on a fix for this syzbot report [1] and didn't realize that you were
> >>> already working on it. I noticed your patch on the mailing list, so i won't
> >>> send a duplicate patch.
> >>>  
> >>>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> >>>
> >>> Could you please add the Reported-by: and Closes: tags from the syzbot report
> >>> to your patch? This will help syzbot associate the patch with the reported
> >>> issue and track the fix.
> >>>
> >>> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> >>>
> >> Could you please address the above when apply the patch? Or should I
> >> resend the patch with them?
> > 
> > I'll do it. Thanks!
> Christian, just wondering, did this fix maybe fall through the cracks?
> This got on my radar because there were a few other reports about this
> regression since then -- and I can't see this or some other fix like
> this in -next.
> 
> At the same time it feels a lot like I'm missing something -- or like
> some deeper problem with all of this turned up meanwhile, which required
> more changes that people are still working on. If it's something like
> that and everything is on track, feel free to just ignore this message.

The problem is fixed. The bug never got outside of linux-next so Christian
just fixed the original commit in his tree.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR