Root Cause Analysis

1. Crash Site & Mechanism

The crash occurs in jbd2_journal_file_inode() (fs/jbd2/transaction.c:2717):

2716:		spin_lock(&journal->j_list_lock);
2717:		WRITE_ONCE(jinode->i_flags, jinode->i_flags | flags);

In struct jbd2_inode, the i_flags field is located at byte offset 0x28 (40 bytes). Here, jinode is passed in as NULL. When KASAN checks the address (0x28 >> 3) + KASAN_SHADOW_OFFSET (dfff800000000005), or when the CPU executes the memory access without KASAN, it faults due to dereferencing 0x0000000000000028 (a NULL pointer dereference) while holding journal->j_list_lock.

2. Lifecycle & Missing Invariant

In ext4, EXT4_I(inode)->jinode is initialized to NULL when an inode is allocated (ext4_alloc_inode(), fs/ext4/super.c:1446). Because attaching a jbd2_inode requires allocating memory (jbd2_alloc_inode(GFP_KERNEL) in ext4_inode_attach_jinode()), ext4 cannot attach jinode inside transaction handles or lock contexts without risking deadlock. Normally, ext4_inode_attach_jinode(inode) is invoked:

1. In ext4_file_open() (fs/ext4/file.c:1008) whenever a file descriptor is opened with FMODE_WRITE.
2. Explicitly prior to write/truncate operations that may operate without opening a file descriptor or after read-only opens, such as ext4_truncate() (fs/ext4/inode.c:5474), ext4_truncate_up() (fs/ext4/inode.c:6917), and ext4_begin_enable_verity() (fs/ext4/verity.c:95).

However, path-based truncate(2) (ksys_truncate -> vfs_truncate -> do_truncate -> notify_change -> ext4_setattr) resolves the file path directly to a dentry/inode and invokes ext4_setattr() without opening a struct file or executing ext4_file_open(). Consequently, if a regular file with inline data was not previously opened for writing in the current mount session, EXT4_I(inode)->jinode remains NULL.

3. Trigger & Call Sequence

Commit ed9356a30e59 ("ext4: convert inline data to extents when truncate exceeds inline size") introduced a check in ext4_setattr() (fs/ext4/inode.c:7128-7133):

	if (ext4_has_inline_data(inode) &&
	    attr->ia_size > EXT4_I(inode)->i_inline_size) {
		error = ext4_convert_inline_data(inode);
		if (error)
			goto err_out;
	}

This check converts an inline-data file to extent-based storage when attr->ia_size exceeds the inline capacity. Crucially, this is called before ext4_truncate_up() (which would have called ext4_inode_attach_jinode()), and neither ext4_setattr() nor ext4_convert_inline_data() (fs/ext4/inline.c:1974-2018) ensures that ext4_inode_attach_jinode(inode) has been called prior to starting the transaction handle.

During the conversion:

1. ext4_convert_inline_data() starts a journal transaction and invokes ext4_convert_inline_data_nolock(handle, inode, &iloc).
2. ext4_convert_inline_data_nolock() destroys inline data and allocates block 0 via ext4_map_blocks(handle, inode, &map, EXT4_GET_BLOCKS_CREATE).
3. In ext4_map_blocks() (fs/ext4/inode.c:960-976), because a new block is allocated on a regular file in default data=ordered mode (ext4_should_order_data(inode) is true), ext4 adds the inode to JBD2's ordered data list:

   ret = ext4_jbd2_inode_add_write(handle, inode, start_byte, length);
   

4. ext4_jbd2_inode_add_write() (fs/ext4/ext4_jbd2.h:336-337) passes EXT4_I(inode)->jinode directly to JBD2:

   return jbd2_journal_inode_ranged_write(handle,
           EXT4_I(inode)->jinode, start_byte, length);
   

5. jbd2_journal_inode_ranged_write() forwards the NULL pointer to jbd2_journal_file_inode(), which immediately crashes when reading jinode->i_flags.