[PATCH v2] block: reject zero length in bio_add_page()

[PATCH v2] block: reject zero length in bio_add_page()

[Qu Wenruo]

The function bio_add_page() returns the number of bytes added to the
bio, and if that failed it should return 0.

However there is a special quirk, if a caller is passing a page with
length 0, that function will always return 0 but with different results:

- The page is added to the bio
  If there is enough bvec slot or the folio can be merged with the last
  bvec.

  The return value 0 is just the length passed in, which is also 0.

- The page is not added to the bio
  If the page is not mergeable with the last bvec, or there is no bvec
  slot available.

  The return value 0 means page is not added into the bio.

Unfortunately the caller is not able to distinguish the above two cases,
and will treat the 0 return value as page addition failure.

In that case, this can lead to the double releasing of the last page:

- By the bio cleanup
  Which normally goes through every page of the bio, including the last
  page which is added into the bio.

- By the caller
  Which believes the page is not added into the bio, thus would manually
  release the page.

I do not think anyone should call bio_add_folio()/bio_add_page() with zero
length, but idiots like me can still show up.

So add an extra WARN_ON_ONCE() check for zero length and rejects it
early to avoid double freeing.

Signed-off-by: Qu Wenruo <wqu@suse.com>
---
Changelog:
- Rewords the commit message
---
 block/bio.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/bio.c b/block/bio.c
index d80d5d26804e..6048d9382fec 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1064,6 +1064,8 @@ int bio_add_page(struct bio *bio, struct page *page,
 {
 	if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED)))
 		return 0;
+	if (WARN_ON_ONCE(len == 0))
+		return 0;
 	if (bio->bi_iter.bi_size > BIO_MAX_SIZE - len)
 		return 0;
 
-- 
2.53.0

Re: [PATCH v2] block: reject zero length in bio_add_page()

[Jens Axboe]

On Tue, 17 Mar 2026 18:36:34 +1030, Qu Wenruo wrote:
> The function bio_add_page() returns the number of bytes added to the
> bio, and if that failed it should return 0.
> 
> However there is a special quirk, if a caller is passing a page with
> length 0, that function will always return 0 but with different results:
> 
> - The page is added to the bio
>   If there is enough bvec slot or the folio can be merged with the last
>   bvec.
> 
> [...]

Applied, thanks!

[1/1] block: reject zero length in bio_add_page()
      commit: 643893647cac7317bafca4040dd0cfb815b510d4

Best regards,
-- 
Jens Axboe