Skip to content

block: Fix dio->ref leak on integrity error in __blkdev_direct_IO()#1005

Open
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1116406=>linus-master
Open

block: Fix dio->ref leak on integrity error in __blkdev_direct_IO()#1005
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1116406=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Jun 25, 2026

Copy link
Copy Markdown

Pull request for series with
subject: block: Fix dio->ref leak on integrity error in __blkdev_direct_IO()
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1116406

@blktests-ci

blktests-ci Bot commented Jun 25, 2026

Copy link
Copy Markdown
Author

Upstream branch: bade58e
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116406
version: 1

@blktests-ci

blktests-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Author

Upstream branch: 4edcdef
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116406
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1116406=>linus-master branch from dcd0613 to 0c9a008 Compare June 26, 2026 08:40
@blktests-ci

blktests-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Author

Upstream branch: 4edcdef
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116406
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1116406=>linus-master branch from 0c9a008 to 787106d Compare June 26, 2026 09:37
@blktests-ci blktests-ci Bot force-pushed the linus-master_base branch from 4cc45a3 to 90ffd56 Compare June 29, 2026 17:14
When __blkdev_direct_IO() splits an I/O across multiple bios and
bio_integrity_map_iter() fails on a non-first bio, the function jumps
to the 'fail' label which frees the current bio without accounting for
the dio->ref increments from previously submitted bios.

The in-flight bios complete normally but their atomic_dec_and_test()
in blkdev_bio_end_io() can never bring dio->ref to zero, leaving the
dio structure (and the first bio it is embedded in) permanently leaked.
For synchronous I/O, the waiter is never woken, causing a hang.

Fix by matching the existing error handling pattern used for
blkdev_iov_iter_get_pages() failure: end the current bio with an error
status and break out of the submission loop. This ensures the normal
completion path properly accounts for all dio->ref references, both
from the current errored bio and from any in-flight bios.

The NOWAIT error path is unaffected as its goto fail only triggers
on the first iteration where no bios have been submitted yet.

Cc: stable@vger.kernel.org
Fixes: 3d8b5a2 ("block: add support to pass user meta buffer")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
@blktests-ci

blktests-ci Bot commented Jun 29, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116406
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1116406=>linus-master branch from 787106d to a5bfdbb Compare June 29, 2026 17:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant