[PATCH] xfs: check split_sectors validity before bio_split call

[PATCH] xfs: check split_sectors validity before bio_split call

[Hongling Zeng]

bio_split() returns ERR_PTR(-EINVAL) when called with sectors <= 0.
The current code only checks for !split_sectors (zero) but not for
negative values.

bio_split_rw_at() can return a negative error code (e.g., -EINVAL,
-EAGAIN) when the bio has alignment issues or REQ_NOWAIT is set.
A negative value bypasses the "!split_sectors" check because negative
values are non-zero.

If we proceed with a negative split_sectors, the left shift operation
(split_sectors << SECTOR_SHIFT) is undefined behavior for signed integers
in C. Even if the implementation somehow handles it, the subsequent
ALIGN_DOWN and bio_split() calls would receive invalid input.

Fix by changing the check from !split_sectors to split_sectors <= 0
immediately after bio_split_rw_at() and before any arithmetic operations.
This prevents both the negative error code propagation and the undefined
behavior from left-shifting negative values.

When NULL is returned, the caller's while loop naturally terminates,
which is the correct behavior for "cannot split" cases.

Fixes: 080d01c41d44f ("xfs: implement zoned garbage collection")
Cc: <stable@vger.kernel.org>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 fs/xfs/xfs_zone_gc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_zone_gc.c b/fs/xfs/xfs_zone_gc.c
index f76a09130852..e00f4771e424 100644
--- a/fs/xfs/xfs_zone_gc.c
+++ b/fs/xfs/xfs_zone_gc.c
@@ -802,7 +802,7 @@ xfs_zone_gc_split_write(
 
 	split_sectors = bio_split_rw_at(&chunk->bio, lim, &nsegs,
 			lim->max_zone_append_sectors << SECTOR_SHIFT);
-	if (!split_sectors)
+	if (split_sectors <= 0)
 		return NULL;
 
 	/* ensure the split chunk is still block size aligned */
-- 
2.25.1

Re: [PATCH] xfs: check split_sectors validity before bio_split call

[Christoph Hellwig]

On Wed, Jul 29, 2026 at 02:31:17PM +0800, Hongling Zeng wrote:
> Fix by changing the check from !split_sectors to split_sectors <= 0
> immediately after bio_split_rw_at() and before any arithmetic operations.
> This prevents both the negative error code propagation and the undefined
> behavior from left-shifting negative values.
> 
> When NULL is returned, the caller's while loop naturally terminates,
> which is the correct behavior for "cannot split" cases.
> 
> Fixes: 080d01c41d44f ("xfs: implement zoned garbage collection")
> Cc: <stable@vger.kernel.org>

Nothing can actually hit that.  It only happens for invalid flags,
or unaligned I/O, none of which can happen for GC I/O.

I think checking all cases of the return value is fine, but the fixes
is a bit bogus, and it really is not stable material.

Re: [PATCH] xfs: check split_sectors validity before bio_split call

[Hongling Zeng]

在 2026年07月29日 14:52, Christoph Hellwig 写道:
> On Wed, Jul 29, 2026 at 02:31:17PM +0800, Hongling Zeng wrote:
>> Fix by changing the check from !split_sectors to split_sectors <= 0
>> immediately after bio_split_rw_at() and before any arithmetic operations.
>> This prevents both the negative error code propagation and the undefined
>> behavior from left-shifting negative values.
>>
>> When NULL is returned, the caller's while loop naturally terminates,
>> which is the correct behavior for "cannot split" cases.
>>
>> Fixes: 080d01c41d44f ("xfs: implement zoned garbage collection")
>> Cc: <stable@vger.kernel.org>
> Nothing can actually hit that.  It only happens for invalid flags,
> or unaligned I/O, none of which can happen for GC I/O.
>
> I think checking all cases of the return value is fine, but the fixes
> is a bit bogus, and it really is not stable material.
  Thanks for the review. Updated v2 below - removed Fixes/stable
   tags and reworded as code improvement.