linux-kernel - [PATCH v2 01/12] block: fix incorrect logic in bio_chain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251128083219.2332407-2-zhangshida@kylinos.cn>
Date: Fri, 28 Nov 2025 16:32:08 +0800
From: zhangshida <starzhangzsd@...il.com>
To: Johannes.Thumshirn@....com,
	hch@...radead.org,
	gruenba@...hat.com,
	ming.lei@...hat.com,
	siangkao@...ux.alibaba.com
Cc: linux-block@...r.kernel.org,
	linux-bcache@...r.kernel.org,
	nvdimm@...ts.linux.dev,
	virtualization@...ts.linux.dev,
	linux-nvme@...ts.infradead.org,
	gfs2@...ts.linux.dev,
	ntfs3@...ts.linux.dev,
	linux-xfs@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	zhangshida@...inos.cn,
	starzhangzsd@...il.com
Subject: [PATCH v2 01/12] block: fix incorrect logic in bio_chain_endio

From: Shida Zhang <zhangshida@...inos.cn>

The `__bio_chain_endio` function, which was intended to serve only as a
flag, contains faulty completion logic. When called, it decrements the
`bi_remaining` count on the *next* bio in the chain without checking its
own.

Consider a bio chain where `bi_remaining` is decremented as each bio in
the chain completes.
For example, if a chain consists of three bios (bio1 -> bio2 -> bio3)
with bi_remaining count:
1->2->2
if the bio completes in the reverse order, there will be a problem.
if bio 3 completes first, it will become:
1->2->1
then bio 2 completes:
1->1->0

Because `bi_remaining` has reached zero, the final `end_io` callback for
the entire chain is triggered, even though not all bios in the chain have
actually finished processing.

As a quick fix, removing `__bio_chain_endio` and allowing the standard
`bio_endio` to handle the completion logic should resolve this issue,
as `bio_endio` correctly manages the `bi_remaining` counter.

Signed-off-by: Shida Zhang <zhangshida@...inos.cn>
---
 block/bio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/bio.c b/block/bio.c
index b3a79285c27..55c2c1a0020 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -322,7 +322,7 @@ static struct bio *__bio_chain_endio(struct bio *bio)

 static void bio_chain_endio(struct bio *bio)
 {
-	bio_endio(__bio_chain_endio(bio));
+	bio_endio(bio);
 }

 /**
-- 
2.34.1