This is a note to let you know that I've just added the patch titled f2fs: fix kernel crash due to null io->bio to the 6.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: f2fs-fix-kernel-crash-due-to-null-io-bio.patch and it can be found in the queue-6.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 267c159f9c7bcb7009dae16889b880c5ed8759a8 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim <jaegeuk@xxxxxxxxxx> Date: Sun, 5 Feb 2023 19:13:39 -0800 Subject: f2fs: fix kernel crash due to null io->bio From: Jaegeuk Kim <jaegeuk@xxxxxxxxxx> commit 267c159f9c7bcb7009dae16889b880c5ed8759a8 upstream. We should return when io->bio is null before doing anything. Otherwise, panic. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] Call Trace: <TASK> f2fs_submit_merged_write+0x1d/0x30 [f2fs] commit_checkpoint+0x110/0x1e0 [f2fs] f2fs_write_checkpoint+0x9f7/0xf00 [f2fs] ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] __checkpoint_and_complete_reqs+0x84/0x190 [f2fs] ? preempt_count_add+0x82/0xc0 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] issue_checkpoint_thread+0x4c/0xf0 [f2fs] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xff/0x130 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> Cc: stable@xxxxxxxxxxxxxxx # v5.18+ Fixes: 64bf0eef0171 ("f2fs: pass the bio operation to bio_alloc_bioset") Reviewed-by: Chao Yu <chao@xxxxxxxxxx> Signed-off-by: Jaegeuk Kim <jaegeuk@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/f2fs/data.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -655,6 +655,9 @@ static void __f2fs_submit_merged_write(s f2fs_down_write(&io->io_rwsem); + if (!io->bio) + goto unlock_out; + /* change META to META_FLUSH in the checkpoint procedure */ if (type >= META_FLUSH) { io->fio.type = META_FLUSH; @@ -663,6 +666,7 @@ static void __f2fs_submit_merged_write(s io->bio->bi_opf |= REQ_PREFLUSH | REQ_FUA; } __submit_merged_bio(io); +unlock_out: f2fs_up_write(&io->io_rwsem); } Patches currently in stable-queue which might be from jaegeuk@xxxxxxxxxx are queue-6.2/f2fs-fix-kernel-crash-due-to-null-io-bio.patch queue-6.2/f2fs-fix-cgroup-writeback-accounting-with-fs-layer-encryption.patch queue-6.2/f2fs-retry-to-update-the-inode-page-given-data-corruption.patch queue-6.2/f2fs-fix-information-leak-in-f2fs_move_inline_dirents.patch queue-6.2/f2fs-revert-f2fs-truncate-blocks-in-batch-in-__complete_revoke_list.patch