Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

On 9/4/26 12:35, Christian Brauner wrote:
> On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
>> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
>>> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
>>>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
>>>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
>>>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
>>>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
>>>> directly") made them point b_data at the kmalloced frozen data rather
>>>> than a folio.  Submitting such a buffer during journal commit oopses:
>>>>
>>>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>>> [...]
>>> I was working on a fix for this syzbot report [1] and didn't realize that you were
>>> already working on it. I noticed your patch on the mailing list, so i won't
>>> send a duplicate patch.
>>>  
>>>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
>>>
>>> Could you please add the Reported-by: and Closes: tags from the syzbot report
>>> to your patch? This will help syzbot associate the patch with the reported
>>> issue and track the fix.
>>>
>>> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
>>>
>> Could you please address the above when apply the patch? Or should I
>> resend the patch with them?
> 
> I'll do it. Thanks!
Christian, just wondering, did this fix maybe fall through the cracks?
This got on my radar because there were a few other reports about this
regression since then -- and I can't see this or some other fix like
this in -next.

At the same time it feels a lot like I'm missing something -- or like
some deeper problem with all of this turned up meanwhile, which required
more changes that people are still working on. If it's something like
that and everything is on track, feel free to just ignore this message.

Ciao, Thorsten