From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-112.freemail.mail.aliyun.com (out30-112.freemail.mail.aliyun.com [115.124.30.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38BC23806CE for ; Mon, 1 Jun 2026 06:51:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.112 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780296666; cv=none; b=swMB+k3pUFvDsA6uwKyylWf88TzCfn5GrG7CPAnMN7t+lSV73nzMPwuw6cSf2tytH/PrH1D2JVIMYI5w4uuhf7ciW5rnnfSA3DDIbC9GHRulcgYH8ZIq8SSL8T515Xcvv7AHyYmFfJD6TSyb0w//P76oh7qRxQStJOnTzSbt9kI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780296666; c=relaxed/simple; bh=3gnkIqDgyH+ynOjStYwfViURO+BmnCTihcdVHMDkmII=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=i4ZqVNaSySFuOrCEaF59FuKLm/2+4a3Xy9dYxXreoIqDiwiZdPm1h8CLRK9SmzbKZ3ROHB/PPaNnY+THRqmLOseCnzY2RHhMmkANwEUsVgh0YHI7eGiTKjqCcphXhUmcLsZ/kkCBi1+2U7keChuaeDeXUpDH/AxmGOeZqH+A1HY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=VGd9oNPj; arc=none smtp.client-ip=115.124.30.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="VGd9oNPj" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1780296657; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=HQz7X9qGCkY3jlvJdIyc9rwIiW2F/tkRtNFML505bo8=; b=VGd9oNPj6/9uz1usaHNwGpAuHjwQdCtoSnS1xrc5Utt7DmZ7HnBoLTW9ljtdkxawVLcyvrQHFOhGAjvJWMaTRZ5Hy2zhTwo7PHSZCnSHGdH2YJfys+ys3pbU0GOYH6Eb6vPIxVi2Le5Gotobvhk9WlCgbNLHCuvq9m2NQCHCkpI= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R761e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam011083073210;MF=joseph.qi@linux.alibaba.com;NM=1;PH=DS;RN=5;SR=0;TI=SMTPD_---0X3yK7nn_1780296656; Received: from 30.134.110.188(mailfrom:joseph.qi@linux.alibaba.com fp:SMTPD_---0X3yK7nn_1780296656 cluster:ay36) by smtp.aliyun-inc.com; Mon, 01 Jun 2026 14:50:57 +0800 Message-ID: <48b50de9-0047-416f-b09d-6e2e0fdeb70d@linux.alibaba.com> Date: Mon, 1 Jun 2026 14:50:56 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] ocfs2: add journal NULL check in ocfs2_checkpoint_inode() To: Heming Zhao Cc: Andrew Morton , Farhad Alemi , ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org References: <20260531131645.3650299-1-joseph.qi@linux.alibaba.com> From: Joseph Qi In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 6/1/26 11:32 AM, Heming Zhao wrote: > On Sun, May 31, 2026 at 09:16:45PM +0800, Joseph Qi wrote: >> During unmount, ocfs2_journal_shutdown() frees the journal and sets >> osb->journal to NULL. Later, when VFS evicts remaining cached inodes, >> ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() >> -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a >> NULL pointer dereference. >> >> Fix this by adding a NULL check for osb->journal in >> ocfs2_checkpoint_inode(). If the journal is NULL, it has already been >> fully flushed and destroyed during shutdown, so there is nothing to >> checkpoint. >> >> Reported-by: Farhad Alemi >> Fixes: da5e7c87827e ("ocfs2: cleanup journal init and shutdown") >> Signed-off-by: Joseph Qi >> Tested-by: Farhad Alemi >> --- >> fs/ocfs2/journal.h | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h >> index 6397170f302f..f8b3b2a3d630 100644 >> --- a/fs/ocfs2/journal.h >> +++ b/fs/ocfs2/journal.h >> @@ -196,6 +196,9 @@ static inline void ocfs2_checkpoint_inode(struct inode *inode) >> if (ocfs2_mount_local(osb)) >> return; >> >> + if (!osb->journal) >> + return; >> + > > In my view, the code is correct for this bug. > However, the if condition is insufficient if ocfs2_journal_shutdown() sets > "journal = NULL" immediately after this line. > During unmount, journal shutdown happens before final inode eviction is triggered by generic_shutdown_super() -> evict_inodes(). That means they run sequentially in the unmount path (same thread context). Thanks, Joseph