From 8a8685b32c0718cc7b2cb4d6202e5a5b8e0a8e2d Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Tue, 4 Aug 2026 05:43:57 -0700 Subject: [PATCH 1/2] iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work. Fixes: 0b10a370529c ("iomap: support T10 protection information") Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: "Darrick J. Wong" Link: https://patch.msgid.link/20260804124404.737145-2-hch@lst.de Signed-off-by: Christian Brauner (Amutable) --- fs/iomap/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/iomap/bio.c b/fs/iomap/bio.c index 4504f4633f17..311199344b28 100644 --- a/fs/iomap/bio.c +++ b/fs/iomap/bio.c @@ -170,7 +170,7 @@ int iomap_bio_read_folio_range_sync(const struct iomap_iter *iter, if (srcmap->flags & IOMAP_F_INTEGRITY) fs_bio_integrity_alloc(&bio); error = submit_bio_wait(&bio); - if (srcmap->flags & IOMAP_F_INTEGRITY) { + if (bio_integrity(&bio)) { if (!error) error = fs_bio_integrity_verify(&bio, sector, len); fs_bio_integrity_free(&bio); From accb6624e383872e7703974a5d5826755fb27032 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Tue, 4 Aug 2026 05:43:58 -0700 Subject: [PATCH 2/2] iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit Which could leak blkg references. Fixes: c03cea42149d ("iomap: add initial support for writes without buffer heads") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260804124404.737145-3-hch@lst.de Reviewed-by: "Darrick J. Wong" Reviewed-by: Anuj Gupta Signed-off-by: Christian Brauner (Amutable) --- fs/iomap/bio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/iomap/bio.c b/fs/iomap/bio.c index 311199344b28..24969b71a965 100644 --- a/fs/iomap/bio.c +++ b/fs/iomap/bio.c @@ -175,5 +175,6 @@ int iomap_bio_read_folio_range_sync(const struct iomap_iter *iter, error = fs_bio_integrity_verify(&bio, sector, len); fs_bio_integrity_free(&bio); } + bio_uninit(&bio); return error; }