linux-kernel - Re: [PATCH Next] gfs2: update end and prev bio for chain bio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_B55495E8E88EEE66CC2C7A1E6FBC2FC16C0A@qq.com>
Date: Sun, 14 Dec 2025 10:17:51 +0800
From: Edward Adam Davis <eadavis@...com>
To: agruenba@...hat.com
Cc: eadavis@...com,
	gfs2@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	syzbot+f6539d4ce3f775aee0cc@...kaller.appspotmail.com
Subject: Re: [PATCH Next] gfs2: update end and prev bio for chain bio

On Fri, 12 Dec 2025 13:47:40 +0100, Andreas Gruenbacher <agruenba@...hat.com> wrote:
> On Mon, Dec 8, 2025 at 7:12 AM Edward Adam Davis <eadavis@...com> wrote:
> > The bios are created and initialized using gfs2_log_alloc_bio() in
> > gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
> > request is too large and needs to be split into multiple bios and
> > submitted as a chain, the bug reported by syzbot [1] is triggered.
> >
> > When we need to submit multiple bios in a chain, we need to pass the
> > bi_end_io and bi_private of the previous bio to the end bio to ensure
> > that the multiple bios are correctly assembled into a submission chain.
> >
> > [1]
> > kernel BUG at block/bio.c:342!
> > Call Trace:
> >  gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
> >  gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
> >  gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
> >
> > Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
> > Reported-by: syzbot+f6539d4ce3f775aee0cc@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
> > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > ---
> >  fs/gfs2/lops.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> > index 97ebe457c00a..2de334034c74 100644
> > --- a/fs/gfs2/lops.c
> > +++ b/fs/gfs2/lops.c
> > @@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
> >         new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
> >         bio_clone_blkg_association(new, prev);
> >         new->bi_iter.bi_sector = bio_end_sector(prev);
> > +       new->bi_end_io = prev->bi_end_io;
> > +       new->bi_private = prev->bi_private;
> > +       prev->bi_end_io = NULL;
> > +       prev->bi_private = NULL;
> >         bio_chain(prev, new);
> >         submit_bio(prev);
> >         return new;
> > --
> > 2.43.0
> >
> 
> thanks for this patch, it looks correct. However, the underlying
> problem is that bi_end_io and bi_private are set too early, and if we
> change the code to set those fields before submitting the bio, we
> won't need this hack in gfs2_chain_bio().
> 
> I have pushed patches doing that onto for-next:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/log/?h=for-next
> 
> Does this work for you?
I think it's work for me.

BR,
Edward