fs/gfs2/log.c:1044 gfs2_remove_from_journal() error: dereferencing freed memory 'bh' (line 1038)

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Andreas Gruenbacher <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   a635d6748234582ea287c5ffeae28b9b23f91c7e
commit: 10866892c79159168459289a1288df4163e94d67 gfs2: Move gfs2_remove_from_journal to log.c
date:   4 months ago
:::::: branch date: 26 hours ago
:::::: commit date: 4 months ago
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260711/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 10866892c791 ("gfs2: Move gfs2_remove_from_journal to log.c")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
fs/gfs2/log.c:1044 gfs2_remove_from_journal() error: dereferencing freed memory 'bh' (line 1038)

Old smatch warnings:
fs/gfs2/log.c:1051 gfs2_remove_from_journal() warn: passing freed memory 'bh' (line 1038)
fs/gfs2/log.c:1181 gfs2_log_flush() error: we previously assumed 'sdp->sd_jdesc' could be null (see line 1134)

vim +/bh +1044 fs/gfs2/log.c

462582b99b6079 Bob Peterson        2020-08-21  1019  
10866892c79159 Andreas Gruenbacher 2026-03-13  1020  void gfs2_remove_from_journal(struct buffer_head *bh, int meta)
10866892c79159 Andreas Gruenbacher 2026-03-13  1021  {
10866892c79159 Andreas Gruenbacher 2026-03-13  1022  	struct address_space *mapping = bh->b_folio->mapping;
10866892c79159 Andreas Gruenbacher 2026-03-13  1023  	struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
10866892c79159 Andreas Gruenbacher 2026-03-13  1024  	struct gfs2_bufdata *bd = bh->b_private;
10866892c79159 Andreas Gruenbacher 2026-03-13  1025  	struct gfs2_trans *tr = current->journal_info;
10866892c79159 Andreas Gruenbacher 2026-03-13  1026  	int was_pinned = 0;
10866892c79159 Andreas Gruenbacher 2026-03-13  1027  
10866892c79159 Andreas Gruenbacher 2026-03-13  1028  	if (test_clear_buffer_pinned(bh)) {
10866892c79159 Andreas Gruenbacher 2026-03-13  1029  		trace_gfs2_pin(bd, 0);
10866892c79159 Andreas Gruenbacher 2026-03-13  1030  		atomic_dec(&sdp->sd_log_pinned);
10866892c79159 Andreas Gruenbacher 2026-03-13  1031  		list_del_init(&bd->bd_list);
10866892c79159 Andreas Gruenbacher 2026-03-13  1032  		if (meta == REMOVE_META)
10866892c79159 Andreas Gruenbacher 2026-03-13  1033  			tr->tr_num_buf_rm++;
10866892c79159 Andreas Gruenbacher 2026-03-13  1034  		else
10866892c79159 Andreas Gruenbacher 2026-03-13  1035  			tr->tr_num_databuf_rm++;
10866892c79159 Andreas Gruenbacher 2026-03-13  1036  		set_bit(TR_TOUCHED, &tr->tr_flags);
10866892c79159 Andreas Gruenbacher 2026-03-13  1037  		was_pinned = 1;
10866892c79159 Andreas Gruenbacher 2026-03-13 @1038  		brelse(bh);
10866892c79159 Andreas Gruenbacher 2026-03-13  1039  	}
10866892c79159 Andreas Gruenbacher 2026-03-13  1040  	if (bd) {
10866892c79159 Andreas Gruenbacher 2026-03-13  1041  		if (bd->bd_tr) {
10866892c79159 Andreas Gruenbacher 2026-03-13  1042  			gfs2_trans_add_revoke(sdp, bd);
10866892c79159 Andreas Gruenbacher 2026-03-13  1043  		} else if (was_pinned) {
10866892c79159 Andreas Gruenbacher 2026-03-13 @1044  			bh->b_private = NULL;
10866892c79159 Andreas Gruenbacher 2026-03-13  1045  			kmem_cache_free(gfs2_bufdata_cachep, bd);
10866892c79159 Andreas Gruenbacher 2026-03-13  1046  		} else if (!list_empty(&bd->bd_ail_st_list) &&
10866892c79159 Andreas Gruenbacher 2026-03-13  1047  			   !list_empty(&bd->bd_ail_gl_list)) {
10866892c79159 Andreas Gruenbacher 2026-03-13  1048  			gfs2_remove_from_ail(bd);
10866892c79159 Andreas Gruenbacher 2026-03-13  1049  		}
10866892c79159 Andreas Gruenbacher 2026-03-13  1050  	}
10866892c79159 Andreas Gruenbacher 2026-03-13  1051  	clear_buffer_dirty(bh);
10866892c79159 Andreas Gruenbacher 2026-03-13  1052  	clear_buffer_uptodate(bh);
10866892c79159 Andreas Gruenbacher 2026-03-13  1053  }
10866892c79159 Andreas Gruenbacher 2026-03-13  1054  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki