linux-kernel - Re: [PATCH v2] bcache: fix I/O accounting leak in detached_dev_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <aXd_QlcF1h9qeULs@studio.local>
Date: Mon, 26 Jan 2026 23:00:56 +0800
From: "Coly Li" <colyli@...as.com>
To: "Christoph Hellwig" <hch@...radead.org>
Cc: <zhangshida2026@....com>, <kent.overstreet@...ux.dev>, <axboe@...nel.dk>, 
	<osandov@...com>, <bvanassche@....org>, <linux-bcache@...r.kernel.org>, 
	<linux-kernel@...r.kernel.org>, <zhangshida@...inos.cn>, 
	<starzhangzsd@...il.com>
Subject: Re: [PATCH v2] bcache: fix I/O accounting leak in detached_dev_do_request

On Mon, Jan 26, 2026 at 04:52:58AM +0800, Christoph Hellwig wrote:
> On Mon, Jan 26, 2026 at 05:28:54PM +0800, zhangshida2026@....com wrote:
> > From: Shida Zhang <zhangshida@...inos.cn>
> > 
> > When a bcache device is in a detached state, iostat can show 100%
> > utilization even after I/O workload completion.
> > 
> > This happens because the caller, cached_dev_make_request(), calls
> > bio_start_io_acct() to begin accounting. However, if the bio hits an
> > early exit path in detached_dev_do_request()—either due to an
> > unsupported discard request or a bio_alloc_clone() failure—the
> > corresponding bio_end_io_acct() is never called. This leaves the
> > in-flight counter permanently incremented, causing the kernel to
> > report the device as 100% busy.
> > 
> > Add the missing bio_end_io_acct() calls to these error/early-exit
> > paths to ensure proper I/O accounting.
> > 
> > Fixes: d62e26b3ffd28 ("block: pass in queue to inflight accounting")
> 
> I don't think that is correct.  This was just a trivial calling
> convention change.
> 

Hi Shida,

This Fixes tag is misleading. The correct to-be-fixed patch is commit
3ef825dfd4e4 ("bcache: use bio cloning for detached device requests")
in linux-block/block-6.19 branch.

Since this patch is not upstreamed yet, the sha-1 commit id might be
changed, so reference the patch name might be fine IMHO.


> From doing a quick git-blame chain this looks like the culprit:
> 
> bc082a55d25c837341709accaf11311c3a9af727
> Author: Tang Junhui <tang.junhui@....com.cn>
> Date:   Sun Mar 18 17:36:19 2018 -0700
> 
>     bcache: fix inaccurate io state for detached bcache devices
> 
> 
> > +		bio_end_io_acct(orig_bio, start_time);
> >  		bio_endio(orig_bio);
> >  		return;
> >  	}
> > @@ -1114,6 +1115,7 @@ static void detached_dev_do_request(struct bcache_device *d,
> >  	clone_bio = bio_alloc_clone(dc->bdev, orig_bio, GFP_NOIO,
> >  				    &d->bio_detached);
> >  	if (!clone_bio) {
> > +		bio_end_io_acct(orig_bio, start_time);
> >  		orig_bio->bi_status = BLK_STS_RESOURCE;
> >  		bio_endio(orig_bio);
> >  		return;
> 
> This is begging to use a goto label to share code, if it weren't for the
> fact that bio_alloc_clone with GFP_NOIO will never return NULL because
> both because the bio itself and the crypt or integrity information are
> backed by mempool.
> 
> So this second copy of the code is actually dead and should be removed
> in a prep patch before this one.  Sorry for not catching this earlier.

Hi Christoph,

Do you mean after using a goto lebal to share code, the second part will
be dead code? Just make sure I don't misunderstand your text.

Thanks.

Coly Li