[PATCH 0/3] xfs: handle ERR_PTR return from bio_split

[PATCH 0/3] xfs: handle ERR_PTR return from bio_split

[Long Li]

bio_split() now returns ERR_PTR() on failure rather than NULL. xfs code
currently ignores the return value of bio_split() and dereferences it
unconditionally, which will crash if bio_split() returns an error pointer.

Add an IS_ERR() check after bio_split(), and perform corresponding error
handling.

Long Li (3):
  xfs: handle ERR_PTR return from bio_split in xfs_buf_submit_bio
  xfs: handle ERR_PTR return from bio_split in xlog_write_iclog
  xfs: handle ERR_PTR return from bio_split in xfs_zone_gc_split_write

 fs/xfs/xfs_buf.c     |  6 ++++++
 fs/xfs/xfs_log.c     |  2 ++
 fs/xfs/xfs_zone_gc.c | 10 +++++++++-
 3 files changed, 17 insertions(+), 1 deletion(-)

-- 
2.39.2

[PATCH 1/3] xfs: handle ERR_PTR return from bio_split in xfs_buf_submit_bio

[Long Li]

bio_split() now returns ERR_PTR() on failure rather than NULL.
xfs_buf_submit_bio() currently ignores the return value and
dereferences it unconditionally, which will crash on error.

Add an IS_ERR() check after bio_split(). On failure, flush the plug
to dispatch any already-chained split bios, then call bio_endio()
with BLK_STS_IOERR on the parent bio. Because bio_chain() increments
the parent's bi_remaining for each chained child, the end_io callback
fires only after all children complete, propagating the error back to
xfs_buf through the normal path.

Fixes: e546fe1da9bd ("block: Rework bio_split() return value")
Signed-off-by: Long Li <leo.lilong@huawei.com>
---
 fs/xfs/xfs_buf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 580d40a5ee57..fda215dd00df 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1268,6 +1268,12 @@ xfs_buf_submit_bio(
 
 		split = bio_split(bio, bp->b_maps[map].bm_len, GFP_NOFS,
 				&fs_bio_set);
+		if (IS_ERR(split)) {
+			blk_finish_plug(&plug);
+			bio->bi_status = BLK_STS_IOERR;
+			bio_endio(bio);
+			return;
+		}
 		split->bi_iter.bi_sector = bp->b_maps[map].bm_bn;
 		bio_chain(split, bio);
 		submit_bio(split);
-- 
2.39.2

[PATCH 2/3] xfs: handle ERR_PTR return from bio_split in xlog_write_iclog

[Long Li]

bio_split() now returns ERR_PTR() on failure. xlog_write_iclog()
currently ignores the return value and dereferences it unconditionally,
which will crash on error.

Add an IS_ERR() check after bio_split(). On failure, fall through to
the existing shutdown path, consistent with how the blkdev_issue_flush()
failure is handled in the same function.

Fixes: e546fe1da9bd ("block: Rework bio_split() return value")
Signed-off-by: Long Li <leo.lilong@huawei.com>
---
 fs/xfs/xfs_log.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index f807f8f4f705..bacc46c53760 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1619,6 +1619,8 @@ xlog_write_iclog(
 
 		split = bio_split(&iclog->ic_bio, log->l_logBBsize - bno,
 				  GFP_NOIO, &fs_bio_set);
+		if (IS_ERR(split))
+			goto shutdown;
 		bio_chain(split, &iclog->ic_bio);
 		submit_bio(split);
 
-- 
2.39.2

[PATCH 3/3] xfs: handle ERR_PTR return from bio_split in xfs_zone_gc_split_write

[Long Li]

bio_split() now returns ERR_PTR() on failure. xfs_zone_gc_split_write()
currently passes the return value directly to container_of() without
checking for errors, which will crash on failure.

Add an IS_ERR() check after bio_split() and propagate the error as
ERR_PTR to the caller xfs_zone_gc_write_chunk(), which handles it by
triggering a filesystem shutdown and freeing the chunk, consistent with
how other I/O errors are handled in that function.

Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection")
Signed-off-by: Long Li <leo.lilong@huawei.com>
---
 fs/xfs/xfs_zone_gc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_zone_gc.c b/fs/xfs/xfs_zone_gc.c
index fedcc47048af..b17782ff81af 100644
--- a/fs/xfs/xfs_zone_gc.c
+++ b/fs/xfs/xfs_zone_gc.c
@@ -811,6 +811,8 @@ xfs_zone_gc_split_write(
 	split_len = split_sectors << SECTOR_SHIFT;
 
 	split = bio_split(&chunk->bio, split_sectors, GFP_NOFS, &data->bio_set);
+	if (IS_ERR(split))
+		return ERR_CAST(split);
 	split_chunk = container_of(split, struct xfs_gc_bio, bio);
 	split_chunk->data = data;
 	ihold(VFS_I(chunk->ip));
@@ -859,8 +861,14 @@ xfs_zone_gc_write_chunk(
 	list_move_tail(&chunk->entry, &data->writing);
 
 	bio_reuse(&chunk->bio, REQ_OP_WRITE);
-	while ((split_chunk = xfs_zone_gc_split_write(data, chunk)))
+	while ((split_chunk = xfs_zone_gc_split_write(data, chunk))) {
+		if (IS_ERR(split_chunk)) {
+			xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
+			xfs_zone_gc_free_chunk(chunk);
+			return;
+		}
 		xfs_zone_gc_submit_write(data, split_chunk);
+	}
 	xfs_zone_gc_submit_write(data, chunk);
 }
 
-- 
2.39.2

Re: [PATCH 1/3] xfs: handle ERR_PTR return from bio_split in xfs_buf_submit_bio

[Donald Douwsma]

On 18/4/26 19:27, Long Li wrote:
> bio_split() now returns ERR_PTR() on failure rather than NULL.
> xfs_buf_submit_bio() currently ignores the return value and
> dereferences it unconditionally, which will crash on error.
> 
> Add an IS_ERR() check after bio_split(). On failure, flush the plug
> to dispatch any already-chained split bios, then call bio_endio()
> with BLK_STS_IOERR on the parent bio. Because bio_chain() increments
> the parent's bi_remaining for each chained child, the end_io callback
> fires only after all children complete, propagating the error back to
> xfs_buf through the normal path.
> 
> Fixes: e546fe1da9bd ("block: Rework bio_split() return value")

This looks like it could cause problems further back?
Perhaps 
    fac69ec8cd74 xfs: simplify buffer I/O submission


Don


> Signed-off-by: Long Li <leo.lilong@huawei.com>
> ---
>  fs/xfs/xfs_buf.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
> index 580d40a5ee57..fda215dd00df 100644
> --- a/fs/xfs/xfs_buf.c
> +++ b/fs/xfs/xfs_buf.c
> @@ -1268,6 +1268,12 @@ xfs_buf_submit_bio(
>  
>  		split = bio_split(bio, bp->b_maps[map].bm_len, GFP_NOFS,
>  				&fs_bio_set);
> +		if (IS_ERR(split)) {
> +			blk_finish_plug(&plug);
> +			bio->bi_status = BLK_STS_IOERR;
> +			bio_endio(bio);
> +			return;
> +		}
>  		split->bi_iter.bi_sector = bp->b_maps[map].bm_bn;
>  		bio_chain(split, bio);
>  		submit_bio(split);

Re: [PATCH 0/3] xfs: handle ERR_PTR return from bio_split

[Carlos Maiolino]

On Sat, Apr 18, 2026 at 05:27:12PM +0800, Long Li wrote:
> bio_split() now returns ERR_PTR() on failure rather than NULL. xfs code
> currently ignores the return value of bio_split() and dereferences it
> unconditionally, which will crash if bio_split() returns an error pointer.
> 
> Add an IS_ERR() check after bio_split(), and perform corresponding error
> handling.
> 
> Long Li (3):
>   xfs: handle ERR_PTR return from bio_split in xfs_buf_submit_bio
>   xfs: handle ERR_PTR return from bio_split in xlog_write_iclog
>   xfs: handle ERR_PTR return from bio_split in xfs_zone_gc_split_write

All those patches should be merged into a single patch. You don't need a single
patch for each function just to handle the same update.

> 
>  fs/xfs/xfs_buf.c     |  6 ++++++
>  fs/xfs/xfs_log.c     |  2 ++
>  fs/xfs/xfs_zone_gc.c | 10 +++++++++-
>  3 files changed, 17 insertions(+), 1 deletion(-)
> 
> -- 
> 2.39.2
> 
>