Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

block: reject zero length in bio_add_page()

The function bio_add_page() returns the number of bytes added to the
bio, and if that failed it should return 0.

However there is a special quirk, if a caller is passing a page with
length 0, that function will always return 0 but with different results:

- The page is added to the bio
If there is enough bvec slot or the folio can be merged with the last
bvec.

The return value 0 is just the length passed in, which is also 0.

- The page is not added to the bio
If the page is not mergeable with the last bvec, or there is no bvec
slot available.

The return value 0 means page is not added into the bio.

Unfortunately the caller is not able to distinguish the above two cases,
and will treat the 0 return value as page addition failure.

In that case, this can lead to the double releasing of the last page:

- By the bio cleanup
Which normally goes through every page of the bio, including the last
page which is added into the bio.

- By the caller
Which believes the page is not added into the bio, thus would manually
release the page.

I do not think anyone should call bio_add_folio()/bio_add_page() with zero
length, but idiots like me can still show up.

So add an extra WARN_ON_ONCE() check for zero length and rejects it
early to avoid double freeing.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Link: https://patch.msgid.link/bc2223c080f38d0b63f968f605c918181c840f40.1773734749.git.wqu@suse.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Qu Wenruo and committed by
Jens Axboe
64389364 3141e0e5

+2
+2
block/bio.c
··· 1026 1026 { 1027 1027 if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED))) 1028 1028 return 0; 1029 + if (WARN_ON_ONCE(len == 0)) 1030 + return 0; 1029 1031 if (bio->bi_iter.bi_size > BIO_MAX_SIZE - len) 1030 1032 return 0; 1031 1033