[PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Joseph Qi]

Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
__bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
5febcba29792 ("jbd2: point the shadow buffer at the frozen data
directly") made them point b_data at the kmalloced frozen data rather
than a folio.  Submitting such a buffer during journal commit oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:__bh_submit.constprop.0+0x87/0x120
  Call Trace:
   jbd2_journal_commit_transaction+0x932/0x1b10
   kjournald2+0xb2/0x250

Hit by the ocfs2-testsuite fill_verify_holes test running with
data=writeback.

Dropbehind only applies to buffers backed by a folio, so skip the check
when b_folio is NULL.

Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
---
 fs/buffer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/buffer.c b/fs/buffer.c
index 427d8a817cd5..f46fa6413032 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
 
 	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
 
-	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
+	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
+	    op_is_write(opf))
 		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
 
 	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
-- 
2.39.3

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Yalagada Pavan Kumar]

On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
Hi,

I was working on a fix for this syzbot report [1] and didn't realize that you were
already working on it. I noticed your patch on the mailing list, so i won't
send a duplicate patch.
 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")

Could you please add the Reported-by: and Closes: tags from the syzbot report
to your patch? This will help syzbot associate the patch with the reported
issue and track the fix.

[1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f

Thank you,
Pavan

> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
> 

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Joseph Qi]

On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
>> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
>> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
>> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
>> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
>> directly") made them point b_data at the kmalloced frozen data rather
>> than a folio.  Submitting such a buffer during journal commit oopses:
>>
>>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>>   Call Trace:
>>    jbd2_journal_commit_transaction+0x932/0x1b10
>>    kjournald2+0xb2/0x250
>>
>> Hit by the ocfs2-testsuite fill_verify_holes test running with
>> data=writeback.
>>
>> Dropbehind only applies to buffers backed by a folio, so skip the check
>> when b_folio is NULL.
>>
> Hi,
> 
> I was working on a fix for this syzbot report [1] and didn't realize that you were
> already working on it. I noticed your patch on the mailing list, so i won't
> send a duplicate patch.
>  
>> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> 
> Could you please add the Reported-by: and Closes: tags from the syzbot report
> to your patch? This will help syzbot associate the patch with the reported
> issue and track the fix.
> 
> [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> 
Hi Christian,
Could you please address the above when apply the patch? Or should I
resend the patch with them?

Thanks,
Joseph 

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Christian Brauner]

On Thu, Sep 03, 2026 at 09:42:27AM +0800, Joseph Qi wrote:
> 
> 
> On 9/3/26 4:52 AM, Yalagada Pavan Kumar wrote:
> > On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> >> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> >> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> >> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> >> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> >> directly") made them point b_data at the kmalloced frozen data rather
> >> than a folio.  Submitting such a buffer during journal commit oopses:
> >>
> >>   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
> >>   Call Trace:
> >>    jbd2_journal_commit_transaction+0x932/0x1b10
> >>    kjournald2+0xb2/0x250
> >>
> >> Hit by the ocfs2-testsuite fill_verify_holes test running with
> >> data=writeback.
> >>
> >> Dropbehind only applies to buffers backed by a folio, so skip the check
> >> when b_folio is NULL.
> >>
> > Hi,
> > 
> > I was working on a fix for this syzbot report [1] and didn't realize that you were
> > already working on it. I noticed your patch on the mailing list, so i won't
> > send a duplicate patch.
> >  
> >> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> > 
> > Could you please add the Reported-by: and Closes: tags from the syzbot report
> > to your patch? This will help syzbot associate the patch with the reported
> > issue and track the fix.
> > 
> > [1]: https://syzkaller.appspot.com/bug?extid=41453ea05ab61c075f1f
> > 
> Hi Christian,
> Could you please address the above when apply the patch? Or should I
> resend the patch with them?

I'll do it. Thanks!

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Greg Ociepka]

On Wed, 2 Sep 2026 09:33:57 +0800, Joseph Qi wrote:
> Since commit 8deae2284976 ("buffer: allow a buffer_head to point at
> memory outside the page cache"), bh->b_folio may be NULL.

We hit the same NULL dereference independently on real hardware, and
it is nastier than a fuzzer-only finding: on an ext4 root filesystem
every boot of next-20260831 (and every later tag up to next-20260903)
dies about two minutes in. jbd2's shadow buffers have no b_folio by
design, so the first journal commit after mount oopses in
__bh_submit(), kjournald2 is killed by make_task_dead() and every
subsequent metadata write blocks forever - journald, the flush workers
and eventually all of userspace wedge in uninterruptible sleep with no
block-layer errors reported. After an unclean shutdown the crash moves
into early boot (journal recovery commits immediately), which makes
the machine effectively unbootable until a different kernel is chosen.

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  CPU: 0 UID: 0 PID: 357 Comm: jbd2/nvme0n1p18 Tainted: G        W  7.3.0-rc1-next-20260831
  pc : __bh_submit+0xa8/0x210
  Call trace:
   __bh_submit+0xa8/0x210 (P)
   bh_submit+0x24/0x38
   jbd2_journal_commit_transaction+0xb80/0x1ce8
   kjournald2+0xb8/0x238

With this exact change applied on top of next-20260831 the same
machine (ASUS Zenbook A16 UX3607OA, Snapdragon X2 Elite, arm64) boots
reliably and has been running normally for 11+ hours.

Tested-by: Greg Ociepka <greg@ferrisoft.com>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Gong Shuai]

> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
>
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
>
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---


Hi Joseph,

Thanks for the fix.

On the OrangePi RV2 single-board (SpacemiT K1, riscv64) I hit the NULL
pointer dereference while testing other patches on top of linux-next
(next-20260904).

The jbd2/mmcblk1p3-N commit thread crashed in __bh_submit() when
submitting a journal shadow buffer whose b_folio is NULL. On this
board the crash reproduced reliably, roughly 3 minutes after boot,
under normal filesystem activity on the ext4 rootfs (buildroot-based
minimal userspace).

After applying this fix, the same kernel/board combination has been
running stably for several hours with no errors.

Tested-by: Gong Shuai <gsh517025@gmail.com> # OrangePi-RV2

Best regards,
Shuai


>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
>

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Dang Huynh]

Hi Joseph Qi,

I have the same issue on my Orange Pi 5 (next-20260904) and this patch
fixed it. Been running for at least an hour without any issues.

Tested-by: Dang Huynh <dang.huynh@mainlining.org> # Orange Pi 5

On Wed, Sep 02, 2026 at 09:33:57AM +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
> 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
>  
>  	if (IS_ENABLED(CONFIG_FS_ENCRYPTION))
> -- 
> 2.39.3
> 

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Chris Paterson]

On Wed, 2 Sep 2026 09:33:57 +0800, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
>
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
>
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
>
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>

This patch fixes the same error we've been seeing on various Renesas RZ
platforms. Tested on RZ/V2H EVK, RZ/V2N EVK and SMARC RZ/G3E EVK.

Tested-by: Chris Paterson <chris.paterson2@renesas.com>

Thanks!
Chris

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Konrad Dybcio]

On 9/2/26 3:33 AM, Joseph Qi wrote:
> Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> directly") made them point b_data at the kmalloced frozen data rather
> than a folio.  Submitting such a buffer during journal commit oopses:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
>   Call Trace:
>    jbd2_journal_commit_transaction+0x932/0x1b10
>    kjournald2+0xb2/0x250
> 
> Hit by the ocfs2-testsuite fill_verify_holes test running with
> data=writeback.
> 
> Dropbehind only applies to buffers backed by a folio, so skip the check
> when b_folio is NULL.
> 
> Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 427d8a817cd5..f46fa6413032 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
>  
>  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
>  
> -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> +	    op_is_write(opf))
>  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);


-next has been broken for a week+ already, please pick this up..

Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # multiple QC boards

Konrad

Re: [PATCH] buffer: fix NULL dereference of bh->b_folio in __bh_submit()

[Jan Kara]

On Thu 10-09-26 10:08:55, Konrad Dybcio wrote:
> On 9/2/26 3:33 AM, Joseph Qi wrote:
> > Commit a2c924c240e7 ("buffer: set BIO_COMPLETE_IN_TASK for dropbehind
> > writeback") added an unconditional folio_test_dropbehind(bh->b_folio) in
> > __bh_submit().  But jbd2 shadow buffers have a NULL b_folio since commit
> > 5febcba29792 ("jbd2: point the shadow buffer at the frozen data
> > directly") made them point b_data at the kmalloced frozen data rather
> > than a folio.  Submitting such a buffer during journal commit oopses:
> > 
> >   BUG: kernel NULL pointer dereference, address: 0000000000000000
> >   RIP: 0010:__bh_submit.constprop.0+0x87/0x120
> >   Call Trace:
> >    jbd2_journal_commit_transaction+0x932/0x1b10
> >    kjournald2+0xb2/0x250
> > 
> > Hit by the ocfs2-testsuite fill_verify_holes test running with
> > data=writeback.
> > 
> > Dropbehind only applies to buffers backed by a folio, so skip the check
> > when b_folio is NULL.
> > 
> > Fixes: 5febcba29792 ("jbd2: point the shadow buffer at the frozen data directly")
> > Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
> > Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sm7225-fairphone-fp4
> > Reviewed-by: Jan Kara <jack@suse.cz>
> > Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> > ---
> >  fs/buffer.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/buffer.c b/fs/buffer.c
> > index 427d8a817cd5..f46fa6413032 100644
> > --- a/fs/buffer.c
> > +++ b/fs/buffer.c
> > @@ -1106,7 +1106,8 @@ static void __bh_submit(struct buffer_head *bh, blk_opf_t opf,
> >  
> >  	bio = bio_alloc(bh->b_bdev, 1, opf, GFP_NOIO);
> >  
> > -	if (folio_test_dropbehind(bh->b_folio) && op_is_write(opf))
> > +	if (bh->b_folio && folio_test_dropbehind(bh->b_folio) &&
> > +	    op_is_write(opf))
> >  		bio_set_flag(bio, BIO_COMPLETE_IN_TASK);
> 
> 
> -next has been broken for a week+ already, please pick this up..

Christian has pushed out a branch with the fixed version of the code today
so hopefully it should get fixed in linux-next soon.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR