linux-kernel - Re: [next-20260108]kernel BUG at drivers/scsi/scsi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aWClEA6KuLP6E1cP@fedora>
Date: Fri, 9 Jan 2026 14:49:52 +0800
From: Ming Lei <ming.lei@...hat.com>
To: Christoph Hellwig <hch@...radead.org>
Cc: Venkat Rao Bagalkote <venkat88@...ux.ibm.com>,
	linux-block@...r.kernel.org, linux-scsi@...r.kernel.org,
	Jens Axboe <axboe@...nel.dk>, James.Bottomley@...senpartnership.com,
	leonro@...dia.com, kch@...dia.com,
	LKML <linux-kernel@...r.kernel.org>,
	Madhavan Srinivasan <maddy@...ux.ibm.com>, riteshh@...ux.ibm.com,
	ojaswin@...ux.ibm.com
Subject: Re: [next-20260108]kernel BUG at drivers/scsi/scsi_lib.c:1173!

On Thu, Jan 08, 2026 at 09:56:39PM -0800, Christoph Hellwig wrote:
> I've seen the same when running xfstests on xfs, and bisected it to:
> 
> commit ee623c892aa59003fca173de0041abc2ccc2c72d
> Author: Ming Lei <ming.lei@...hat.com>
> Date:   Wed Dec 31 11:00:55 2025 +0800
> 
>     block: use bvec iterator helper for bio_may_need_split()
> 

Hi Christoph and Venkat Rao Bagalkote,

Unfortunately I can't duplicate the issue in my environment, can you test
the following patch?

diff --git a/block/blk.h b/block/blk.h
index 98f4dfd4ec75..980eef1f5690 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -380,7 +380,7 @@ static inline bool bio_may_need_split(struct bio *bio,
                return true;
 
        bv = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
-       if (bio->bi_iter.bi_size > bv->bv_len)
+       if (bio->bi_iter.bi_size > bv->bv_len - bio->bi_iter.bi_bvec_done)
                return true;
        return bv->bv_len + bv->bv_offset > lim->max_fast_segment_size;
 }


Thanks,
Ming