From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.mainlining.org (mail.mainlining.org [5.75.144.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C751360EDE for ; Tue, 8 Sep 2026 05:33:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=5.75.144.95 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788845597; cv=none; b=ftYF+I7NCbODHzmCtrPkFNSkPsUnmUXrhti2GMX3QiHJ1H1mdcuKnb4qkz4qY0fow2Jvad3o48LtjWwHm0SHN11YJqA7/jsIdFpcNdS1NSfZIl2o2yjNGBbyB1b4VXND2coKfuuxTX90TV/wVI+aKjXCtxYap7tXtusMczjvrps= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788845597; c=relaxed/simple; bh=dltaH28yUjQQlHMbETH41/bwEToJ8j3Tnd1zRYasmoY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=V4YUvgWLt98eYbr5dYeB0EEXX0rhFE8QxhmrzJWSvw9KCM7+jI356IQnq7H2RtfP/b/VmmA7KBPeNCmPMJ6HxhpE1H4M6TnKS+pMgmIk1f+Ffec3hm1/uXq9j9st6TDqr45yUgmGIoOjWQDUpqIsDP/DYeS1hjmR3aSjez/aU6A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mainlining.org; spf=pass smtp.mailfrom=mainlining.org; dkim=pass (2048-bit key) header.d=mainlining.org header.i=@mainlining.org header.b=Asdo7YPL; dkim=permerror (0-bit key) header.d=mainlining.org header.i=@mainlining.org header.b=IgOkvxgQ; arc=none smtp.client-ip=5.75.144.95 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mainlining.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mainlining.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=mainlining.org header.i=@mainlining.org header.b="Asdo7YPL"; dkim=permerror (0-bit key) header.d=mainlining.org header.i=@mainlining.org header.b="IgOkvxgQ" DKIM-Signature: v=1; a=rsa-sha256; s=202507r; d=mainlining.org; c=relaxed/relaxed; h=Message-ID:Subject:To:From:Date; t=1788845584; bh=JoGBcgZLjUjt6VU2m3AjQN3 W9Ha4kS+Fchgk2bcEpFQ=; b=Asdo7YPLF/TekBShRaprBgqTSEyNNJRCoZ9A6FWC2mSGG1Yitp VUIlCvtqC1EoWHNMgd4IxPLIGMY4RXup/Q4iiIlx+T9RSU7Pgp3wO6Uz5YpUg85AAkAZlH2A2ZZ dtsrCCeoi9CJ5d3+Rycg9D18TyLIR1Q3lab8v5wj6jPXI07lx4+LHi4r0IPJg2A2WBR2S02jaBK 3kJWPnDnrNI7oT2hlI1FcBB3t3AF/C9okJ8Ha0CFyiPscY8WVshRMvugCc2rtTyVwml4tPBMbYK 7qH2spDYiSSpc36BTAAKVOf6bcTyk1XbCamhPc6iDZ0z04edhvXem2wEMZ+oDA7Su/A==; DKIM-Signature: v=1; a=ed25519-sha256; s=202507e; d=mainlining.org; c=relaxed/relaxed; h=Message-ID:Subject:To:From:Date; t=1788845584; bh=JoGBcgZLjUjt6VU2m3AjQN3 W9Ha4kS+Fchgk2bcEpFQ=; b=IgOkvxgQUcbwHbp/r9PXPqqW/A+EqZpzdEPWWC2WsCFzuqiPH9 1EerW4WWv8JBGfAGFMkbik1yfBzjs2EfLiDQ==; Date: Tue, 8 Sep 2026 05:32:57 +0000 From: Dang Huynh To: Joseph Qi Cc: Christian Brauner , linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org, ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Srikanth Aithal , Luca Weiss , Jan Kara Subject: Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit() Message-ID: References: <20260902013357.2815214-1-joseph.qi@linux.alibaba.com> Precedence: bulk X-Mailing-List: ocfs2-devel@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260902013357.2815214-1-joseph.qi@linux.alibaba.com> Hi Joseph Qi, I have the same issue on my Orange Pi 5 (next-20260904) and this patch fixed it. Been running for at least an hour without any issues. Tested-by: Dang Huynh # Orange Pi 5 On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote: > Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind > writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in > __bh_submit(). But jbd2 shadow buffers have a NULL b_folio since commit > 5febcba29792 ("jbd2: point the shadow buffer at the frozen data > directly") made them point b_data at the kmalloced frozen data rather > than a folio. Submitting such a buffer during journal commit oopses: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > RIP: 0010:__bh_submit.constprop.0+0x87/0x120 > Call Trace: > jbd2_journal_commit_transaction+0x932/0x1b10 > kjournald2+0xb2/0x250 > > Hit by the ocfs2-testsuite fill_verify_holes test running with > data=writeback. > > Dropbehind only applies to buffers backed by a folio, so skip the check > when b_folio is NULL. > > Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly") > Tested-by: Srikanth Aithal > Tested-by: Luca Weiss # sm7225-fairphone-fp4 > Reviewed-by: Jan Kara > Signed-off-by: Joseph Qi > --- > fs/buffer.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/buffer.c b/fs/buffer.c > index 427d8a817cd5..f46fa6413032 100644 > --- a/fs/buffer.c > +++ b/fs/buffer.c > @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf, > > bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO); > > - if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf)) > + if (bh->b_folio && folio_test_dropbehind(bh->b_folio) && > + op_is_write(opf)) > bio_set_flag(bio, BIO_COMPLETE_IN_TASK); > > if (IS_ENABLED(CONFIG_FS_ENCRYPTION)) > -- > 2.39.3 >