From: Qu Wenruo <wqu@suse.com>
To: "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>
Subject: Should bio_add_folio() add the folio even it returned false for @len == 0 case?
Date: Fri, 13 Mar 2026 12:45:54 +1030 [thread overview]
Message-ID: <4810d3dc-22bf-4a8d-9964-017c2fdf3c3b@suse.com> (raw)
Hi,
Normally no one should call bio_add_folio() with a zero length, but when
that happened, bio_add_folio() will always return false.
However if the bio has enough free bvec slots, that folio will still be
added to that folio, breaking that "returning false meaning addition
failed" assumption.
This can result folio double freeing (well, if you ignore the bigger bug
of queuing zero length in the first place), as return false normally
means the add failed, caller normally needs to release that folio manually.
But caller also needs to cleanup that folio, which involves releasing
each queued folio, resulting double freeing of the last added folio.
Thus I'm wondering if we should add a @len == 0 check (maybe with a
WARN_ON_ONCE() too) in bio_add_page().
And please don't ask me why/how I hit this, I'm already embarrassed
enough to hit it in the first place.
Thanks,
Qu
reply other threads:[~2026-03-13 2:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4810d3dc-22bf-4a8d-9964-017c2fdf3c3b@suse.com \
--to=wqu@suse.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox