linux-kernel - Re: Fix potential data loss and corruption due to Incorrect BIO Chain Handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aSP5svsQfFe8x8Fb@infradead.org>
Date: Sun, 23 Nov 2025 22:22:42 -0800
From: Christoph Hellwig <hch@...radead.org>
To: Stephen Zhang <starzhangzsd@...il.com>
Cc: Christoph Hellwig <hch@...radead.org>, linux-kernel@...r.kernel.org,
	linux-block@...r.kernel.org, nvdimm@...ts.linux.dev,
	virtualization@...ts.linux.dev, linux-nvme@...ts.infradead.org,
	gfs2@...ts.linux.dev, ntfs3@...ts.linux.dev,
	linux-xfs@...r.kernel.org, zhangshida@...inos.cn
Subject: Re: Fix potential data loss and corruption due to Incorrect BIO
 Chain Handling

On Sat, Nov 22, 2025 at 02:38:59PM +0800, Stephen Zhang wrote:
> ======code analysis======
> In kernel version 4.19, XFS handles extent I/O using the ioend structure,

Linux 4.19 is more than four years old, and both the block I/O code
and the XFS/iomap code changed a lot since then.

> changes the logic. Since there are still many code paths that use
> bio_chain, I am including these cleanups with the fix. This provides a reason
> to CC all related communities. That way, developers who are monitoring
> this can help identify similar problems if someone asks for help in the future,
> if that is the right analysis and fix.

As many pointed out something in the analysis doesn't end up.  How do
you even managed to call bio_chain_endio as almost no one should be
calling it.  Are you using bcache?  Are the others callers in the
obsolete kernel you are using?  Are they calling it without calling
bio_endio first (which the bcache case does, and which is buggy).