fixes for iomap_bio_read_folio_range_sync

fixes for iomap_bio_read_folio_range_sync

[Christoph Hellwig]

Hi all,

two fixes for iomap_bio_read_folio_range_sync, a potential kernel
crash when tweaking the device integrity behvavior using sysfs,
and a missing bio_uninit that the Sashiko review of the first fix
found.

[PATCH 1/2] iomap: don't free integrity payload that doesn't exist

[Christoph Hellwig]

fs_bio_integrity_alloc might not allocate a bio integrity payload if PI
verification is disabled on the block device.  Check for that case before
calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to
avoid a NULL pointer dereferences.

Make the branch cover the PI verification as well - while
fs_bio_integrity_verify works without an integrity payload, it requires
one to actually do useful work.

Fixes: 0b10a370529c ("iomap: support T10 protection information")
Cc: <stable@vger.kernel.org> # v7.1
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
---
 fs/iomap/bio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/iomap/bio.c b/fs/iomap/bio.c
index dc8ac7e370a5..30ef78a66b4f 100644
--- a/fs/iomap/bio.c
+++ b/fs/iomap/bio.c
@@ -179,7 +179,7 @@ int iomap_bio_read_folio_range_sync(const struct iomap_iter *iter,
 	if (srcmap->flags & IOMAP_F_INTEGRITY)
 		fs_bio_integrity_alloc(&bio);
 	error = submit_bio_wait(&bio);
-	if (srcmap->flags & IOMAP_F_INTEGRITY) {
+	if (bio_integrity(&bio)) {
 		if (!error)
 			error = fs_bio_integrity_verify(&bio, sector, len);
 		fs_bio_integrity_free(&bio);
-- 
2.53.0

[PATCH 2/2] iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit

[Christoph Hellwig]

Which could leak blkg references.

Fixes: c03cea42149d ("iomap: add initial support for writes without buffer heads")
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 fs/iomap/bio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/iomap/bio.c b/fs/iomap/bio.c
index 30ef78a66b4f..48100c614431 100644
--- a/fs/iomap/bio.c
+++ b/fs/iomap/bio.c
@@ -184,5 +184,6 @@ int iomap_bio_read_folio_range_sync(const struct iomap_iter *iter,
 			error = fs_bio_integrity_verify(&bio, sector, len);
 		fs_bio_integrity_free(&bio);
 	}
+	bio_uninit(&bio);
 	return error;
 }
-- 
2.53.0

Re: [PATCH 2/2] iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit

[Darrick J. Wong]

On Tue, Aug 04, 2026 at 05:43:58AM -0700, Christoph Hellwig wrote:
> Which could leak blkg references.
> 
> Fixes: c03cea42149d ("iomap: add initial support for writes without buffer heads")
> Signed-off-by: Christoph Hellwig <hch@lst.de>

Makes sense that we have to uninit that which we initted earlier;
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

> ---
>  fs/iomap/bio.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/iomap/bio.c b/fs/iomap/bio.c
> index 30ef78a66b4f..48100c614431 100644
> --- a/fs/iomap/bio.c
> +++ b/fs/iomap/bio.c
> @@ -184,5 +184,6 @@ int iomap_bio_read_folio_range_sync(const struct iomap_iter *iter,
>  			error = fs_bio_integrity_verify(&bio, sector, len);
>  		fs_bio_integrity_free(&bio);
>  	}
> +	bio_uninit(&bio);
>  	return error;
>  }
> -- 
> 2.53.0
> 
>