From: Jens Axboe <axboe@kernel.dk>
Date: Thu, 12 Feb 2026 11:07:41 +0000 (-0700)
Subject: block: fix folio leak in bio_iov_iter_bounce_read()
X-Git-Tag: v7.0-rc1~67^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5991bfa3f88ec8d67fa3f552c19c39ff37a4e67b;p=thirdparty%2Fkernel%2Fstable.git

block: fix folio leak in bio_iov_iter_bounce_read()

If iov_iter_extract_bvecs() returns an error or zero bytes extracted,
then the folio allocated is leaked on return. Ensure it's put before
returning.

Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/block/bio.c b/block/bio.c
index b291b9aaeee1d..8203bb7455a9f 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1382,8 +1382,10 @@ static int bio_iov_iter_bounce_read(struct bio *bio, struct iov_iter *iter)
 		ret = iov_iter_extract_bvecs(iter, bio->bi_io_vec + 1, len,
 				&bio->bi_vcnt, bio->bi_max_vecs - 1, 0);
 		if (ret <= 0) {
-			if (!bio->bi_vcnt)
+			if (!bio->bi_vcnt) {
+				folio_put(folio);
 				return ret;
+			}
 			break;
 		}
 		len -= ret;