Re: [PATCH] jbd2: don't advance j_fc_off before the buffer is recorded

[Theodore Ts'o]

On Wed, 19 Aug 2026 15:09:39 +0900, Daejun Park wrote:
> jbd2_fc_get_buf() increments journal->j_fc_off before jbd2_journal_bmap()
> and __getblk() have had a chance to fail.  When either does, the slot
> j_fc_wbuf[fc_off] is never assigned, but j_fc_off already counts it.
> 
> ext4 then fails the fast commit and falls back, and the fallback path
> reaches jbd2_fc_release_bufs() via ext4_fc_commit ->
> jbd2_fc_end_commit_fallback -> __jbd2_fc_end_commit -> ext4_fc_cleanup.
> That walks down from j_fc_off - 1 and put_bh()es every slot until it
> sees NULL, so it also touches the slot that was never written.
> j_fc_wbuf comes from a plain kmalloc() and is never zeroed, so a slot
> used for the first time holds uninitialised heap data.
> 
> [...]

Applied, thanks!

[1/1] jbd2: don't advance j_fc_off before the buffer is recorded
      commit: 9f359c031885bb50add7d23c7a5a0e9755b134c9

Best regards,
-- 
Theodore Ts'o <tytso@xxxxxxx>