From 691b052139c94ee6640ac39e0b764dd3867897c0 Mon Sep 17 00:00:00 2001 From: Mike Waychison Date: Wed, 15 Jul 2026 15:29:50 -0400 Subject: [PATCH 01/11] block: fix race in blk_time_get_ns() returning 0 blk_time_get_ns() populates the per-plug cached timestamp and then returns it by re-reading the field: if (!plug->cur_ktime) { plug->cur_ktime = ktime_get_ns(); current->flags |= PF_BLOCK_TS; } return plug->cur_ktime; This is problematic when the compiler emits the final "return plug->cur_ktime" as a reload from memory, after PF_BLOCK_TS has already been set. Since the cached timestamp is now invalidated from finish_task_switch() (fad156c2af22 "block: invalidate cached plug timestamp after task switch"), a task preempted between setting PF_BLOCK_TS and that reload has plug->cur_ktime zeroed by blk_plug_invalidate_ts() when it is scheduled back in. The reload then returns 0. A 0 handed back here is stored as a start timestamp -- e.g. blk_account_io_start() writes it to rq->start_time_ns -- and later subtracted from "now". blk_account_io_done() then adds (now - 0), i.e. roughly the system uptime, to the per-group nsecs[] counters. On an otherwise idle, healthy device this appears as sudden ~uptime-sized jumps in the diskstats time fields (write_ticks/discard_ticks/time_in_queue). The solution is to be explicit in our reads and writes to this field that is preemption volatile. We also add a barrier() to ensure that any setting of PF_BLOCK_TS is ordered to happen after the cur_ktime update. This issue was discovered using AI-assisted kprobes looking for paths that were leaking zeroed timestamps in a live system, based on the observation that we were sometimes seeing uptime-sized jumps in kernel exported counters. This was flagged by NodeDiskIOSaturation prometheus alerts that started firing on all hosts post 7.1.3 kernel upgrade, due to node-exporter now exporting a nonsensical node_disk_io_time_weighted_seconds_total. Fixes: fad156c2af22 ("block: invalidate cached plug timestamp after task switch") Cc: stable@vger.kernel.org Signed-off-by: Mike Waychison Assisted-by: Claude:claude-opus-4.8 Link: https://patch.msgid.link/20260715192950.2488921-1-mike@waychison.com Signed-off-by: Jens Axboe --- block/blk.h | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/block/blk.h b/block/blk.h index fb95d3c58950..eaac05815cb0 100644 --- a/block/blk.h +++ b/block/blk.h @@ -717,6 +717,7 @@ static inline int req_ref_read(struct request *req) static inline u64 blk_time_get_ns(void) { struct blk_plug *plug = current->plug; + u64 now; if (!plug || !in_task()) return ktime_get_ns(); @@ -725,12 +726,18 @@ static inline u64 blk_time_get_ns(void) * 0 could very well be a valid time, but rather than flag "this is * a valid timestamp" separately, just accept that we'll do an extra * ktime_get_ns() if we just happen to get 0 as the current time. + * + * cur_ktime can be zeroed by pre-emption the moment PF_BLOCK_TS is set. */ - if (!plug->cur_ktime) { - plug->cur_ktime = ktime_get_ns(); + now = READ_ONCE(plug->cur_ktime); + if (!now) { + now = ktime_get_ns(); + WRITE_ONCE(plug->cur_ktime, now); + /* Ensure PF_BLOCK_TS is set after cur_ktime. */ + barrier(); current->flags |= PF_BLOCK_TS; } - return plug->cur_ktime; + return now; } static inline ktime_t blk_time_get(void) From c4f4c0fc551cbcdccbbbc2d874d7d6440c7b4983 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Wed, 15 Jul 2026 21:39:57 +0200 Subject: [PATCH 02/11] loop: remove manually added partitions on detach Commit 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") stopped disk_force_media_change() from setting GD_NEED_PART_SCAN because loop devices with LO_FLAGS_PARTSCAN rescan partitions explicitly. However, partitions can also be added manually with BLKPG while LO_FLAGS_PARTSCAN is clear. When such a loop device is detached, __loop_clr_fd() skips bdev_disk_changed(). Without GD_NEED_PART_SCAN, reopening the unbound device no longer performs the previous lazy cleanup, leaving dead partition devices behind. A subsequent LOOP_CONFIGURE can then fail its partition scan with -EBUSY, as seen in blktests loop/009 after loop/008. Call bdev_disk_changed() unconditionally during __loop_clr_fd(). The disk capacity is already zero and the release path holds open_mutex, so this drops all partitions without rescanning the detached backing file. The new blktests loop/013 case covers this sequence by adding a partition with BLKPG without LO_FLAGS_PARTSCAN, detaching the loop device, and checking that the partition is gone when the device is reopened. Fixes: 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202607150754.b660f5b9-lkp@intel.com Signed-off-by: Daan De Meyer Link: https://patch.msgid.link/20260715-b4-loop-partition-cleanup-v1-1-b9f59910cd1e@amutable.com Signed-off-by: Jens Axboe --- drivers/block/loop.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 310de0463beb..1faecef33009 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1113,6 +1113,7 @@ static void __loop_clr_fd(struct loop_device *lo) struct queue_limits lim; struct file *filp; gfp_t gfp = lo->old_gfp_mask; + int err; spin_lock_irq(&lo->lo_lock); filp = lo->lo_backing_file; @@ -1146,26 +1147,21 @@ static void __loop_clr_fd(struct loop_device *lo) disk_force_media_change(lo->lo_disk); - if (lo->lo_flags & LO_FLAGS_PARTSCAN) { - int err; - - /* - * open_mutex has been held already in release path, so don't - * acquire it if this function is called in such case. - * - * If the reread partition isn't from release path, lo_refcnt - * must be at least one and it can only become zero when the - * current holder is released. - */ - err = bdev_disk_changed(lo->lo_disk, false); - if (err) - pr_warn("%s: partition scan of loop%d failed (rc=%d)\n", - __func__, lo->lo_number, err); - /* Device is gone, no point in returning error */ - } + /* + * Remove all partitions, including partitions added manually with + * BLKPG, which may exist even if LO_FLAGS_PARTSCAN is not set. + * + * open_mutex has been held already in release path, so don't acquire + * it here. + */ + err = bdev_disk_changed(lo->lo_disk, false); + if (err) + pr_warn("%s: partition scan of loop%d failed (rc=%d)\n", + __func__, lo->lo_number, err); + /* Device is gone, no point in returning error */ /* - * lo->lo_state is set to Lo_unbound here after above partscan has + * lo->lo_state is set to Lo_unbound here after removing partitions has * finished. There cannot be anybody else entering __loop_clr_fd() as * Lo_rundown state protects us from all the other places trying to * change the 'lo' device. From dbbca20764382b4d411ec2918f4e278ffe547acc Mon Sep 17 00:00:00 2001 From: Tao Cui Date: Wed, 15 Jul 2026 21:24:07 +0800 Subject: [PATCH 03/11] blk-cgroup: fix leaks and online flag on radix_tree_insert failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When radix_tree_insert() fails in blkg_create(), the error path has two issues: 1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block. 2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed. Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy(). Acked-by: Tejun Heo Signed-off-by: Tao Cui Link: https://patch.msgid.link/20260715132407.1469777-1-cui.tao@linux.dev Signed-off-by: Jens Axboe --- block/blk-cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index d2a1f5903f24..d9676126c5b5 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -434,15 +434,15 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, struct gendisk *disk, blkg->pd[i]->online = true; } } + blkg->online = true; } - blkg->online = true; spin_unlock(&blkcg->lock); if (!ret) return blkg; /* @blkg failed fully initialized, use the usual release path */ - blkg_put(blkg); + percpu_ref_kill(&blkg->refcnt); return ERR_PTR(ret); err_free_blkg: From d35e236282992e583ed9c1b7ab52e9ef1b873585 Mon Sep 17 00:00:00 2001 From: Michael Bommarito Date: Tue, 14 Jul 2026 07:48:06 -0400 Subject: [PATCH 04/11] partitions: aix: bound the lvd scan to one sector aix_partition() reads the logical-volume descriptor array as a single sector and then scans it: if (numlvs && (d = read_part_sector(state, vgda_sector + 1, §))) { struct lvd *p = (struct lvd *)d; ... for (i = 0; foundlvs < numlvs && i < state->limit; i++) { lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps); p points at a single 512-byte sector, which holds SECTOR_SIZE / sizeof(struct lvd) = 16 entries, but the loop runs until foundlvs reaches the on-disk numlvs or i reaches state->limit (DISK_MAX_PARTS, 256). numlvs is an on-disk __be16 read straight from the volume group descriptor and is not validated, so a crafted AIX image with numlvs larger than 16 and lvd entries whose num_lps fields are zero (so foundlvs never advances) drives the loop to read p[i] well past the end of the read sector buffer. Commit d97a86c170b4 ("partitions: aix.c: off by one bug") hardened the matching write of lvip[lv_ix] in 2014 but left this read loop unbounded. Bound the scan to the number of struct lvd entries that fit in the sector that was actually read. Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260714114806.3761553-1-michael.bommarito@gmail.com Signed-off-by: Jens Axboe --- block/partitions/aix.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/block/partitions/aix.c b/block/partitions/aix.c index f3c4174e003e..689837deba27 100644 --- a/block/partitions/aix.c +++ b/block/partitions/aix.c @@ -208,7 +208,14 @@ int aix_partition(struct parsed_partitions *state) if (n) { int foundlvs = 0; - for (i = 0; foundlvs < numlvs && i < state->limit; i += 1) { + /* + * The lvd array was read as a single sector; only the + * struct lvd entries that fit in it are valid. Bound the + * scan so an on-disk numlvs larger than that cannot walk + * the read buffer out of bounds. + */ + for (i = 0; foundlvs < numlvs && i < state->limit && + i < SECTOR_SIZE / (int)sizeof(struct lvd); i++) { lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps); if (lvip[i].pps_per_lv) foundlvs += 1; From daff723f2d4c618d5f9186a990f47bf75878abeb Mon Sep 17 00:00:00 2001 From: Qu Wenruo Date: Tue, 14 Jul 2026 18:37:39 +0930 Subject: [PATCH 05/11] block: do not warn when doing greedy allocation in folio_alloc_greedy() During one of my local btrfs fstests runs, folio_alloc() inside folio_alloc_greedy() triggered an allocation failure report when trying to allocate an order-4 folio. The kernel is from the latest development branch, which is utilizing the IOMAP_DIO_BOUNCE flag for direct writes when the inode requires checksum. Unfortunately I didn't save the full log, only the function and the order. When the IOMAP_DIO_BOUNCE flag is utilized, we will hit the following call chain: bio_iov_iter_bounce_write() |- folio_alloc_greedy() |- folio_alloc(gfp | __GFP_NORETRY, get_order(*size)); However __GFP_NORETRY will still emit an allocation failure report when it fails. And folio_alloc_greedy() will retry with a smaller order anyway, there is no point in emitting that allocation failure report. Append the __GFP_NOWARN flag to folio_alloc() for the larger-order folio attempts. Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Qu Wenruo Link: https://patch.msgid.link/d10571445ee505d95ba6eaad7558fc1f556d2921.1784020005.git.wqu@suse.com Signed-off-by: Jens Axboe --- block/bio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/bio.c b/block/bio.c index f2a5f4d0a967..5ac954c70dd0 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1285,7 +1285,8 @@ static struct folio *folio_alloc_greedy(gfp_t gfp, size_t *size, struct folio *folio; while (*size > minsize) { - folio = folio_alloc(gfp | __GFP_NORETRY, get_order(*size)); + folio = folio_alloc(gfp | __GFP_NORETRY | __GFP_NOWARN, + get_order(*size)); if (folio) return folio; *size = rounddown_pow_of_two(*size - 1); From bd2df8dc72201f626d66ca97f2afc8b7f2740713 Mon Sep 17 00:00:00 2001 From: Jackie Liu Date: Wed, 15 Jul 2026 15:35:18 +0800 Subject: [PATCH 06/11] block: free copied pages when blk_rq_map_kern() fails bio_copy_kern() allocates pages that are normally freed by the bio completion callback. If blk_rq_append_bio() rejects the bio, however, blk_rq_map_kern() only drops the bio reference. Since bio_put() does not free pages referenced by the bio vectors, those pages leak. This can happen when the bio exceeds the queue segment constraints or when a later mapping cannot be merged into a request built by earlier calls. Track whether the buffer was copied and free those pages before dropping the rejected bio. Fixes: 3a5a39276d2a ("block: allow blk_rq_map_kern to append to requests") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Jackie Liu Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260715073518.96042-1-liu.yun@linux.dev Signed-off-by: Jens Axboe --- block/blk-map.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/block/blk-map.c b/block/blk-map.c index 768549f19f97..d1d6bbe0ecf1 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -653,6 +653,7 @@ int blk_rq_map_kern(struct request *rq, void *kbuf, unsigned int len, gfp_t gfp_mask) { unsigned long addr = (unsigned long) kbuf; + bool do_copy; struct bio *bio; int ret; @@ -661,7 +662,8 @@ int blk_rq_map_kern(struct request *rq, void *kbuf, unsigned int len, if (!len || !kbuf) return -EINVAL; - if (!blk_rq_aligned(rq->q, addr, len) || object_is_on_stack(kbuf)) + do_copy = !blk_rq_aligned(rq->q, addr, len) || object_is_on_stack(kbuf); + if (do_copy) bio = bio_copy_kern(rq, kbuf, len, gfp_mask); else bio = bio_map_kern(rq, kbuf, len, gfp_mask); @@ -670,8 +672,11 @@ int blk_rq_map_kern(struct request *rq, void *kbuf, unsigned int len, return PTR_ERR(bio); ret = blk_rq_append_bio(rq, bio); - if (unlikely(ret)) + if (unlikely(ret)) { + if (do_copy) + bio_free_pages(bio); blk_mq_map_bio_put(bio); + } return ret; } EXPORT_SYMBOL(blk_rq_map_kern); From 4ff58d6bc9dd4c7fe6092d0ab5677a79ebc788af Mon Sep 17 00:00:00 2001 From: Shin'ichiro Kawasaki Date: Thu, 16 Jul 2026 18:22:37 +0900 Subject: [PATCH 07/11] block: serialize elevator changes for the same queue using a writer lock When elevator_change() is called concurrently for the same queue, the elevator_change_done() function runs concurrently as well. This function adds or deletes kobjects for the debugfs entry of the queue. Then the concurrent calls cause memory corruption of the kobjects and result in a process hang. The core part of the elevator switch is protected by queue freeze and q->elevator_lock. However, since the commit 559dc11143eb ("block: move elv_register[unregister]_queue out of elevator_lock"), the elevator_change_done() is not serialized. Hence the memory corruption and the hang. The failures are observed when udev-worker writes to a sysfs queue/scheduler attribute file while the blktests test case block/005 writes to the same attribute file. The failure also can be recreated by running two processes that write to the same queue/scheduler file concurrently. The failure is observed since another commit 370ac285f23a ("block: avoid cpu_hotplug_lock depedency on freeze_lock"). This commit changed the behavior of queue freeze and it unveiled the failure. Fix the failure by changing elv_iosched_store() to acquire update_nr_hwq_lock as the writer lock instead of the reader lock. This serializes the whole elevator switch steps, including the elevator_change_done() call. Fixes: 559dc11143eb ("block: move elv_register[unregister]_queue out of elevator_lock") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260716092237.1305030-1-shinichiro.kawasaki@wdc.com Signed-off-by: Jens Axboe --- block/elevator.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/block/elevator.c b/block/elevator.c index 3bcd37c2aa34..2161b6eea680 100644 --- a/block/elevator.c +++ b/block/elevator.c @@ -812,8 +812,13 @@ ssize_t elv_iosched_store(struct gendisk *disk, const char *buf, * reference during concurrent disk deletion: * update_nr_hwq_lock -> kn->active (via del_gendisk -> kobject_del) * kn->active -> update_nr_hwq_lock (via this sysfs write path) + * + * Use the writer lock instead of the reader lock of update_nr_hwq_lock + * to serialize the two-stage elevator switch steps in + * elevator_change(): the core switch step under the elevator lock and + * the elevator_change_done() step outside the elevator lock. */ - if (!down_read_trylock(&set->update_nr_hwq_lock)) { + if (!down_write_trylock(&set->update_nr_hwq_lock)) { ret = -EBUSY; goto out; } @@ -824,7 +829,7 @@ ssize_t elv_iosched_store(struct gendisk *disk, const char *buf, } else { ret = -ENOENT; } - up_read(&set->update_nr_hwq_lock); + up_write(&set->update_nr_hwq_lock); out: if (ctx.type) From f94de432646ebec7857ba2624fe082e779b52572 Mon Sep 17 00:00:00 2001 From: Jackie Liu Date: Wed, 15 Jul 2026 15:33:41 +0800 Subject: [PATCH 08/11] block: show operation in error injection rules Rules listed through the error_injection debugfs file omit the block operation they match. As a result, rules that differ only in operation are indistinguishable even though op is mandatory when adding a rule. Signed-off-by: Jackie Liu Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260715073341.95129-1-liu.yun@linux.dev Signed-off-by: Jens Axboe --- block/error-injection.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/block/error-injection.c b/block/error-injection.c index cfb83138960c..e14bc4b723ef 100644 --- a/block/error-injection.c +++ b/block/error-injection.c @@ -276,9 +276,10 @@ static int blk_error_injection_show(struct seq_file *s, void *private) rcu_read_lock(); list_for_each_entry_rcu(inj, &disk->error_injection_list, entry) { - seq_printf(s, "%llu:%llu status=%s,chance=%u", - inj->start, inj->end, - blk_status_to_tag(inj->status), inj->chance); + seq_printf(s, "%llu:%llu op=%s,status=%s,chance=%u", + inj->start, inj->end, + blk_op_str(inj->op), + blk_status_to_tag(inj->status), inj->chance); seq_putc(s, '\n'); } rcu_read_unlock(); From 447cfed6d700bfbd5a7120f8ea5821a0e1191667 Mon Sep 17 00:00:00 2001 From: Joseph Qi Date: Thu, 9 Jul 2026 10:01:45 +0800 Subject: [PATCH 09/11] block: try slab allocation in bio_alloc_bioset() before mempool When the per-CPU bio cache is enabled but empty, bio_alloc_percpu_cache() returns NULL and bio_alloc_bioset() falls straight through to the mempool fallback: if (unlikely(!bio)) { if (!(saved_gfp & __GFP_DIRECT_RECLAIM)) return NULL; ... } For non-sleeping allocations (no __GFP_DIRECT_RECLAIM) this returns NULL without ever attempting a slab allocation, even when there is plenty of free memory. Commit b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") introduced this. Before it, a percpu cache miss fell through to mempool_alloc(), which attempted the underlying slab allocation first and only failed when that slab allocation failed. The restructuring dropped the slab attempt that non-sleeping callers of a cache-enabled bioset (such as the default fs_bio_set used by bio_alloc()) relied on. Try a slab allocation with optimistic GFP_ flags before falling back to the mempool whenever the bio is still NULL, so both the cache-empty and non-cache paths share the same slab attempt. This restores the previous behavior for non-sleeping allocations. Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Suggested-by: Christoph Hellwig Signed-off-by: Joseph Qi Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260709020145.4011533-1-joseph.qi@linux.alibaba.com Signed-off-by: Jens Axboe --- block/bio.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/block/bio.c b/block/bio.c index 5ac954c70dd0..de56d3f10c56 100644 --- a/block/bio.c +++ b/block/bio.c @@ -555,6 +555,14 @@ struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs, bio = bio_alloc_percpu_cache(bs); } else { opf &= ~REQ_ALLOC_CACHE; + } + + /* + * For a bioset without a percpu cache, or when the percpu cache was + * empty, try a slab allocation with optimistic GFP_ flags before + * falling back to the mempool. + */ + if (!bio) { p = kmem_cache_alloc(bs->bio_slab, gfp); if (p) bio = p + bs->front_pad; From 4f221efff9b32fb4206f8db240a2b35a7d27696d Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 16 Jul 2026 11:12:45 +0200 Subject: [PATCH 10/11] block: handle huge zero folios in bio_free_folios When CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is enabled, iomap_dio_zero() can add a huge zero folio to a zeroing bio, which needs special treatment in bio_free_folios by also checking is_huge_zero_folio() in addition to is_zero_folio(). Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260716091306.316625-2-hch@lst.de Signed-off-by: Jens Axboe --- block/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/bio.c b/block/bio.c index de56d3f10c56..ebb6d3e53ac3 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1311,7 +1311,7 @@ static void bio_free_folios(struct bio *bio) bio_for_each_bvec_all(bv, bio, i) { struct folio *folio = bvec_folio(bv); - if (!is_zero_folio(folio)) + if (!is_zero_folio(folio) && !is_huge_zero_folio(folio)) folio_put(folio); } } From df308a14585649f7683a560f5c94978ab4f8224d Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 16 Jul 2026 11:12:46 +0200 Subject: [PATCH 11/11] block: fix aligning of bounced dio read bios bio_iov_iter_align_down expects the "normal" biovec layout from vector 0, while bio_iov_iter_bounce_read abuses vector 0 for a bounce buffer allocation. Pass an explicit bvec to bio_iov_iter_align_down to deal with this case to avoid a double unpin. Additionally we need to free the folio if no bio_vec could be added, and adjust the size of the first bio_vec that contains the bounce buffer when the I/O size is aligned down. Fixes: e7b8b3c5b2a6 ("block: align down bounces bios") Reported-by: 0wnerD1ed Signed-off-by: Christoph Hellwig Tested-by: 0wnerD1ed Reviewed-by: Keith Busch Link: https://patch.msgid.link/20260716091306.316625-3-hch@lst.de Signed-off-by: Jens Axboe --- block/bio.c | 51 ++++++++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/block/bio.c b/block/bio.c index ebb6d3e53ac3..6a2f6fc3413e 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1199,7 +1199,7 @@ void bio_iov_bvec_set(struct bio *bio, const struct iov_iter *iter) * for the next iteration. */ static int bio_iov_iter_align_down(struct bio *bio, struct iov_iter *iter, - unsigned len_align_mask) + struct bio_vec *bv, unsigned len_align_mask) { size_t nbytes = bio->bi_iter.bi_size & len_align_mask; @@ -1208,23 +1208,16 @@ static int bio_iov_iter_align_down(struct bio *bio, struct iov_iter *iter, iov_iter_revert(iter, nbytes); bio->bi_iter.bi_size -= nbytes; - do { - struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1]; - - if (nbytes < bv->bv_len) { - bv->bv_len -= nbytes; - break; - } - + while (nbytes >= bv->bv_len) { if (bio_flagged(bio, BIO_PAGE_PINNED)) unpin_user_page(bv->bv_page); - bio->bi_vcnt--; + if (!--bio->bi_vcnt) + return -EFAULT; nbytes -= bv->bv_len; - } while (nbytes); - - if (!bio->bi_vcnt) - return -EFAULT; + bv--; + } + bv->bv_len -= nbytes; return 0; } @@ -1284,7 +1277,8 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter, if (is_pci_p2pdma_page(bio->bi_io_vec->bv_page)) bio->bi_opf |= REQ_NOMERGE; - return bio_iov_iter_align_down(bio, iter, len_align_mask); + return bio_iov_iter_align_down(bio, iter, + &bio->bi_io_vec[bio->bi_vcnt - 1], len_align_mask); } static struct folio *folio_alloc_greedy(gfp_t gfp, size_t *size, @@ -1369,7 +1363,8 @@ static int bio_iov_iter_bounce_write(struct bio *bio, struct iov_iter *iter, if (!bio->bi_iter.bi_size) return -ENOMEM; - return bio_iov_iter_align_down(bio, iter, minsize - 1); + return bio_iov_iter_align_down(bio, iter, + &bio->bi_io_vec[bio->bi_vcnt - 1], minsize - 1); } static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter, @@ -1377,21 +1372,18 @@ static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter, { size_t len = min3(iov_iter_count(iter), maxlen, SZ_1M); struct folio *folio; + ssize_t ret; folio = folio_alloc_greedy(GFP_KERNEL, &len, minsize); if (!folio) return -ENOMEM; do { - ssize_t ret; - ret = iov_iter_extract_bvecs(iter, bio->bi_io_vec + 1, len, &bio->bi_vcnt, bio->bi_max_vecs - 1, 0); if (ret <= 0) { - if (!bio->bi_vcnt) { - folio_put(folio); - return ret; - } + if (!bio->bi_vcnt) + goto out_folio_put; break; } len -= ret; @@ -1407,7 +1399,20 @@ static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter, bvec_set_folio(&bio->bi_io_vec[0], folio, bio->bi_iter.bi_size, 0); if (iov_iter_extract_will_pin(iter)) bio_set_flag(bio, BIO_PAGE_PINNED); - return bio_iov_iter_align_down(bio, iter, minsize - 1); + + /* The first vec stores the bounce buffer, so do not subtract 1 here. */ + ret = bio_iov_iter_align_down(bio, iter, + &bio->bi_io_vec[bio->bi_vcnt], minsize - 1); + if (ret) + goto out_folio_put; + + /* Update the bounc buffer bv_len to the aligned down size. */ + bio->bi_io_vec[0].bv_len = bio->bi_iter.bi_size; + return 0; + +out_folio_put: + folio_put(folio); + return ret; } /**