[PATCH] block: fix EOD return for device with nr_sectors == 0

[PATCH] block: fix EOD return for device with nr_sectors == 0

[Jens Axboe]

A recent commit skipped dumping the usual "attempt to access beyond end
of device" message if the device size is 0 sectors, as that's a common
pattern for devices that have been hot removed. But while it stopped
that message, it also prevented returning -EIO for that condition.
Reinstate the -EIO return, while retaining the quiet operation for
triggering EOD for a device with 0 sectors.

Reported-by: syzbot+4b12286339fe4c2700c1@syzkaller.appspotmail.com
Reported-by: Sahil Chandna <chandna.linuxkernel@gmail.com>
Fixes: d0a2b527d8c3 ("block: tone down bio_check_eod")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/block/blk-core.c b/block/blk-core.c
index 4201504158a1..a27185cd8ede 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -557,9 +557,11 @@ static inline int bio_check_eod(struct bio *bio)
 	sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
 	unsigned int nr_sectors = bio_sectors(bio);
 
-	if (nr_sectors && maxsector &&
+	if (nr_sectors &&
 	    (nr_sectors > maxsector ||
 	     bio->bi_iter.bi_sector > maxsector - nr_sectors)) {
+		if (!maxsector)
+			return -EIO;
 		pr_info_ratelimited("%s: attempt to access beyond end of device\n"
 				    "%pg: rw=%d, sector=%llu, nr_sectors = %u limit=%llu\n",
 				    current->comm, bio->bi_bdev, bio->bi_opf,

-- 
Jens Axboe

Re: [PATCH] block: fix EOD return for device with nr_sectors == 0

[Sahil Chandna]

On 9/22/25 5:28 PM, Jens Axboe wrote:
> A recent commit skipped dumping the usual "attempt to access beyond end
> of device" message if the device size is 0 sectors, as that's a common
> pattern for devices that have been hot removed. But while it stopped
> that message, it also prevented returning -EIO for that condition.
> Reinstate the -EIO return, while retaining the quiet operation for
> triggering EOD for a device with 0 sectors.
> 
> Reported-by: syzbot+4b12286339fe4c2700c1@syzkaller.appspotmail.com
> Reported-by: Sahil Chandna <chandna.linuxkernel@gmail.com>
> Fixes: d0a2b527d8c3 ("block: tone down bio_check_eod")
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> 
> ---
> 
> diff --git a/block/blk-core.c b/block/blk-core.c
> index 4201504158a1..a27185cd8ede 100644
> --- a/block/blk-core.c
> +++ b/block/blk-core.c
> @@ -557,9 +557,11 @@ static inline int bio_check_eod(struct bio *bio)
>   	sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
>   	unsigned int nr_sectors = bio_sectors(bio);
>   
> -	if (nr_sectors && maxsector &&
> +	if (nr_sectors &&
>   	    (nr_sectors > maxsector ||
>   	     bio->bi_iter.bi_sector > maxsector - nr_sectors)) {
> +		if (!maxsector)
> +			return -EIO;
>   		pr_info_ratelimited("%s: attempt to access beyond end of device\n"
>   				    "%pg: rw=%d, sector=%llu, nr_sectors = %u limit=%llu\n",
>   				    current->comm, bio->bi_bdev, bio->bi_opf,
> 
Hi,
I tested the patch and it *does not* reproduce the original syzkaller 
bug [1].
Tested-by: Sahil Chandna <chandna.linuxkernel@gmail.com>

[1] https://syzkaller.appspot.com./bug?extid=4b12286339fe4c2700c1

Re: [PATCH] block: fix EOD return for device with nr_sectors == 0

[Jens Axboe]

On 9/22/25 7:48 AM, Sahil Chandna wrote:
> 
> 
> On 9/22/25 5:28 PM, Jens Axboe wrote:
>> A recent commit skipped dumping the usual "attempt to access beyond end
>> of device" message if the device size is 0 sectors, as that's a common
>> pattern for devices that have been hot removed. But while it stopped
>> that message, it also prevented returning -EIO for that condition.
>> Reinstate the -EIO return, while retaining the quiet operation for
>> triggering EOD for a device with 0 sectors.
>>
>> Reported-by: syzbot+4b12286339fe4c2700c1@syzkaller.appspotmail.com
>> Reported-by: Sahil Chandna <chandna.linuxkernel@gmail.com>
>> Fixes: d0a2b527d8c3 ("block: tone down bio_check_eod")
>> Signed-off-by: Jens Axboe <axboe@kernel.dk>
>>
>> ---
>>
>> diff --git a/block/blk-core.c b/block/blk-core.c
>> index 4201504158a1..a27185cd8ede 100644
>> --- a/block/blk-core.c
>> +++ b/block/blk-core.c
>> @@ -557,9 +557,11 @@ static inline int bio_check_eod(struct bio *bio)
>>       sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
>>       unsigned int nr_sectors = bio_sectors(bio);
>>   -    if (nr_sectors && maxsector &&
>> +    if (nr_sectors &&
>>           (nr_sectors > maxsector ||
>>            bio->bi_iter.bi_sector > maxsector - nr_sectors)) {
>> +        if (!maxsector)
>> +            return -EIO;
>>           pr_info_ratelimited("%s: attempt to access beyond end of device\n"
>>                       "%pg: rw=%d, sector=%llu, nr_sectors = %u limit=%llu\n",
>>                       current->comm, bio->bi_bdev, bio->bi_opf,
>>
> Hi,
> I tested the patch and it *does not* reproduce the original syzkaller bug [1].
> Tested-by: Sahil Chandna <chandna.linuxkernel@gmail.com>
> 
> [1] https://syzkaller.appspot.com./bug?extid=4b12286339fe4c2700c1

Thanks for testing! And for reporting the issue in the first place.

-- 
Jens Axboe

Re: [PATCH] block: fix EOD return for device with nr_sectors == 0

[Christoph Hellwig]

On Mon, Sep 22, 2025 at 05:58:41AM -0600, Jens Axboe wrote:
> A recent commit skipped dumping the usual "attempt to access beyond end
> of device" message if the device size is 0 sectors, as that's a common
> pattern for devices that have been hot removed. But while it stopped
> that message, it also prevented returning -EIO for that condition.
> Reinstate the -EIO return, while retaining the quiet operation for
> triggering EOD for a device with 0 sectors.

Ooops.  The fix looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>