* [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails
@ 2026-03-03 7:25 Yang Xiuwei
2026-03-03 7:56 ` Ming Lei
2026-03-03 14:08 ` Christoph Hellwig
0 siblings, 2 replies; 4+ messages in thread
From: Yang Xiuwei @ 2026-03-03 7:25 UTC (permalink / raw)
To: axboe; +Cc: tom.leiming, linux-block, Yang Xiuwei
When bio_add_page() fails in bio_copy_kern(), the allocated page
is not freed before breaking the loop, leading to a memory leak.
Fixes: 42d2683a2704 ("block: simplify bio_map_kern")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
diff --git a/block/blk-map.c b/block/blk-map.c
index 53bdd100aa4b..ed0ff4e77833 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -398,8 +398,10 @@ static struct bio *bio_copy_kern(struct request *rq, void *data, unsigned int le
if (op_is_write(op))
memcpy(page_address(page), p, bytes);
- if (bio_add_page(bio, page, bytes, 0) < bytes)
+ if (bio_add_page(bio, page, bytes, 0) < bytes) {
+ __free_page(page);
break;
+ }
len -= bytes;
p += bytes;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails
2026-03-03 7:25 [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails Yang Xiuwei
@ 2026-03-03 7:56 ` Ming Lei
2026-03-03 14:08 ` Christoph Hellwig
1 sibling, 0 replies; 4+ messages in thread
From: Ming Lei @ 2026-03-03 7:56 UTC (permalink / raw)
To: Yang Xiuwei; +Cc: axboe, tom.leiming, linux-block
On Tue, Mar 3, 2026 at 3:25 PM Yang Xiuwei <yangxiuwei@kylinos.cn> wrote:
>
> When bio_add_page() fails in bio_copy_kern(), the allocated page
> is not freed before breaking the loop, leading to a memory leak.
>
> Fixes: 42d2683a2704 ("block: simplify bio_map_kern")
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
>
> diff --git a/block/blk-map.c b/block/blk-map.c
> index 53bdd100aa4b..ed0ff4e77833 100644
> --- a/block/blk-map.c
> +++ b/block/blk-map.c
> @@ -398,8 +398,10 @@ static struct bio *bio_copy_kern(struct request *rq, void *data, unsigned int le
> if (op_is_write(op))
> memcpy(page_address(page), p, bytes);
>
> - if (bio_add_page(bio, page, bytes, 0) < bytes)
> + if (bio_add_page(bio, page, bytes, 0) < bytes) {
> + __free_page(page);
> break;
> + }
Reviewed-by: Ming Lei <ming.lei@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails
2026-03-03 7:25 [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails Yang Xiuwei
2026-03-03 7:56 ` Ming Lei
@ 2026-03-03 14:08 ` Christoph Hellwig
2026-03-04 1:26 ` Yang Xiuwei
1 sibling, 1 reply; 4+ messages in thread
From: Christoph Hellwig @ 2026-03-03 14:08 UTC (permalink / raw)
To: Yang Xiuwei; +Cc: axboe, tom.leiming, linux-block
On Tue, Mar 03, 2026 at 03:25:17PM +0800, Yang Xiuwei wrote:
> When bio_add_page() fails in bio_copy_kern(), the allocated page
> is not freed before breaking the loop, leading to a memory leak.
bio_add_page can't fail here, as the bio is sized correctly using
blk_rq_map_bio_alloc. So if you want to clean this up, please switch
to __bio_add_page instead of adding dead error handling code.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails
2026-03-03 14:08 ` Christoph Hellwig
@ 2026-03-04 1:26 ` Yang Xiuwei
0 siblings, 0 replies; 4+ messages in thread
From: Yang Xiuwei @ 2026-03-04 1:26 UTC (permalink / raw)
To: hch; +Cc: axboe, tom.leiming, linux-block
Hi Christoph,
Thanks for the review. I understand the issue now and will drop this patch.
Thanks,
Yang Xiuwei
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-04 1:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-03 7:25 [PATCH] block: fix page leak in bio_copy_kern when bio_add_page fails Yang Xiuwei
2026-03-03 7:56 ` Ming Lei
2026-03-03 14:08 ` Christoph Hellwig
2026-03-04 1:26 ` Yang Xiuwei
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox