block: mempool alloc fail due to insufficient memory

[PATCH next] block: mempool alloc fail due to insufficient memory

Posted by Edward Adam Davis 1 week, 6 days ago

Add a failure check for mempool_alloc() in the slowpath.

[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:bio_init block/bio.c:214 [inline]
RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline]
RIP: 0010:bio_alloc_bioset+0x664/0xc10 block/bio.c:593
Call Trace:
 bio_alloc include/linux/bio.h:373 [inline]
 submit_bh_wbc+0x22d/0x650 fs/buffer.c:2816

Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath")
Reported-by: syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=09ddb593eea76a158f42
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 block/bio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/block/bio.c b/block/bio.c
index 5057047194c4..0a870979bd41 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -582,6 +582,9 @@ struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs,
 		opf &= ~REQ_ALLOC_CACHE;
 
 		p = mempool_alloc(&bs->bio_pool, gfp);
+		if (unlikely(!p))
+			return NULL;
+
 		bio = p + bs->front_pad;
 		if (nr_vecs > BIO_INLINE_VECS) {
 			nr_vecs = BIO_MAX_VECS;
-- 
2.43.0

Re: [PATCH next] block: mempool alloc fail due to insufficient memory

Posted by Jens Axboe 1 week, 6 days ago

On 3/21/26 2:36 AM, Edward Adam Davis wrote:
> Add a failure check for mempool_alloc() in the slowpath.
> 
> [1]
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> Workqueue: writeback wb_workfn (flush-8:0)
> RIP: 0010:bio_init block/bio.c:214 [inline]
> RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline]
> RIP: 0010:bio_alloc_bioset+0x664/0xc10 block/bio.c:593
> Call Trace:
>  bio_alloc include/linux/bio.h:373 [inline]
>  submit_bh_wbc+0x22d/0x650 fs/buffer.c:2816
> 
> Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath")
> Reported-by: syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=09ddb593eea76a158f42
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>  block/bio.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/block/bio.c b/block/bio.c
> index 5057047194c4..0a870979bd41 100644
> --- a/block/bio.c
> +++ b/block/bio.c
> @@ -582,6 +582,9 @@ struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs,
>  		opf &= ~REQ_ALLOC_CACHE;
>  
>  		p = mempool_alloc(&bs->bio_pool, gfp);
> +		if (unlikely(!p))
> +			return NULL;
> +

Doesn't look right at all. You dropped the backtrace, which shows this is
off __block_write_full_folio() -> submit_bh_wbc() which allocates a bio
from the mempool with GFP_NOIO. That should allow blocking, and hence
mempool_alloc() should NEVER return NULL for that case. If it does,
it's broken, and your change is just papering around that issue.

-- 
Jens Axboe