Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Chris Paterson]

On Wed, 2 Sep 2026 09:33:57 +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
>
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
>
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@xxxxxxx>
> Tested-by: Luca Weiss <luca.weiss@xxxxxxxxxxxxx> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@xxxxxxx>
> Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>

This patch fixes the same error we've been seeing on various Renesas RZ
platforms. Tested on RZ/V2H EVK, RZ/V2N EVK and SMARC RZ/G3E EVK.

Tested-by: Chris Paterson <chris.paterson2@xxxxxxxxxxx>

Thanks!
Chris