Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Jan Kara]

On Fri 18-09-26 08:53:38, Thorsten Leemhuis wrote:
> On 9/4/26 12:35, Christian Brauner wrote:
> > On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
> >> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> >>> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> >>>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> >>>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> >>>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> >>>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> >>>> directly") made them point b_data at the kmalloced frozen data rather
> >>>> than a folio.  Submitting such a buffer during journal commit oopses:
> >>>>
> >>>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >>> [...]
> >>> I was working on a fix for this syzbot report [1] and didn't realize that you were
> >>> already working on it. I noticed your patch on the mailing list, so i won't
> >>> send a duplicate patch.
> >>>  
> >>>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> >>>
> >>> Could you please add the Reported-by: and Closes: tags from the syzbot report
> >>> to your patch? This will help syzbot associate the patch with the reported
> >>> issue and track the fix.
> >>>
> >>> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> >>>
> >> Could you please address the above when apply the patch? Or should I
> >> resend the patch with them?
> > 
> > I'll do it. Thanks!
> Christian, just wondering, did this fix maybe fall through the cracks?
> This got on my radar because there were a few other reports about this
> regression since then -- and I can't see this or some other fix like
> this in -next.
> 
> At the same time it feels a lot like I'm missing something -- or like
> some deeper problem with all of this turned up meanwhile, which required
> more changes that people are still working on. If it's something like
> that and everything is on track, feel free to just ignore this message.

The problem is fixed. The bug never got outside of linux-next so Christian
just fixed the original commit in his tree.

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR