linux-kernel - [PATCH] dm: pass origin bio's bdev to bio_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260116120744.908987-1-chengzhihao1@huawei.com>
Date: Fri, 16 Jan 2026 20:07:44 +0800
From: Zhihao Cheng <chengzhihao1@...wei.com>
To: <agk@...hat.com>, <snitzer@...nel.org>, <mpatocka@...hat.com>,
	<bmarzins@...hat.com>
CC: <dm-devel@...ts.linux.dev>, <linux-kernel@...r.kernel.org>,
	<chengzhihao1@...wei.com>, <yangerkun@...wei.com>, <lilingfeng3@...wei.com>
Subject: [PATCH] dm: pass origin bio's bdev to bio_alloc_clone

The origin bio carries blk-cgroup information which could be set from
foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't
control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to
bio_alloc_clone"). The synchronous io is still under control by blkcg,
because 'bio->bi_blkg' is set by io submitting task which has been
added into 'cgroup.procs'.

Fix it by passing origin bio's bdev to bio_alloc_clone.

Fetch a reproducer in [Link].

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985
Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
Signed-off-by: Zhihao Cheng <chengzhihao1@...wei.com>
---
 drivers/md/dm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index b63279202260..e763e3b02a9f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -574,7 +574,8 @@ static struct dm_io *alloc_io(struct mapped_device *md, struct bio *bio, gfp_t g
 	struct dm_target_io *tio;
 	struct bio *clone;
 
-	clone = bio_alloc_clone(NULL, bio, gfp_mask, &md->mempools->io_bs);
+	clone = bio_alloc_clone(bio->bi_bdev, bio,
+				gfp_mask, &md->mempools->io_bs);
 	if (unlikely(!clone))
 		return NULL;
 	tio = clone_to_tio(clone);
@@ -623,7 +624,7 @@ static struct bio *alloc_tio(struct clone_info *ci, struct dm_target *ti,
 		/* alloc_io() already initialized embedded clone */
 		clone = &tio->clone;
 	} else {
-		clone = bio_alloc_clone(NULL, ci->bio, gfp_mask,
+		clone = bio_alloc_clone(ci->bio->bi_bdev, ci->bio, gfp_mask,
 					&md->mempools->bs);
 		if (!clone)
 			return NULL;
-- 
2.52.0