linux-kernel - Re: [PATCH Next] gfs2: update end and prev bio for chain bio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHc6FU6q=pvFTcWL8CLv+qXAyRw8DmYqdHgUr=qBWF16uozCmQ@mail.gmail.com>
Date: Wed, 14 Jan 2026 09:46:10 +0100
From: Andreas Gruenbacher <agruenba@...hat.com>
To: Edward Adam Davis <eadavis@...com>
Cc: gfs2@...ts.linux.dev, linux-kernel@...r.kernel.org, 
	syzbot+f6539d4ce3f775aee0cc@...kaller.appspotmail.com
Subject: Re: [PATCH Next] gfs2: update end and prev bio for chain bio

On Sun, Dec 14, 2025 at 3:18 AM Edward Adam Davis <eadavis@...com> wrote:
> On Fri, 12 Dec 2025 13:47:40 +0100, Andreas Gruenbacher <agruenba@...hat.com> wrote:
> > On Mon, Dec 8, 2025 at 7:12 AM Edward Adam Davis <eadavis@...com> wrote:
> > > The bios are created and initialized using gfs2_log_alloc_bio() in
> > > gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
> > > request is too large and needs to be split into multiple bios and
> > > submitted as a chain, the bug reported by syzbot [1] is triggered.
> > >
> > > When we need to submit multiple bios in a chain, we need to pass the
> > > bi_end_io and bi_private of the previous bio to the end bio to ensure
> > > that the multiple bios are correctly assembled into a submission chain.
> > >
> > > [1]
> > > kernel BUG at block/bio.c:342!
> > > Call Trace:
> > >  gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
> > >  gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
> > >  gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
> > >
> > > Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
> > > Reported-by: syzbot+f6539d4ce3f775aee0cc@...kaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
> > > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > > ---
> > >  fs/gfs2/lops.c | 4 ++++
> > >  1 file changed, 4 insertions(+)
> > >
> > > diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> > > index 97ebe457c00a..2de334034c74 100644
> > > --- a/fs/gfs2/lops.c
> > > +++ b/fs/gfs2/lops.c
> > > @@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
> > >         new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
> > >         bio_clone_blkg_association(new, prev);
> > >         new->bi_iter.bi_sector = bio_end_sector(prev);
> > > +       new->bi_end_io = prev->bi_end_io;
> > > +       new->bi_private = prev->bi_private;
> > > +       prev->bi_end_io = NULL;
> > > +       prev->bi_private = NULL;
> > >         bio_chain(prev, new);
> > >         submit_bio(prev);
> > >         return new;
> > > --
> > > 2.43.0
> > >
> >
> > thanks for this patch, it looks correct. However, the underlying
> > problem is that bi_end_io and bi_private are set too early, and if we
> > change the code to set those fields before submitting the bio, we
> > won't need this hack in gfs2_chain_bio().
> >
> > I have pushed patches doing that onto for-next:
> >
> >   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/log/?h=for-next
> >
> > Does this work for you?
>
> I think it's work for me.

It turns out that commit 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
was bad and needed to be reverted. This means that patch "gfs2: Set
bio->{bi_private,bi_end_ino} late" has been dropped from for-next as
well.

Thanks,
Andreas