From: Qu Wenruo Date: Tue, 17 Mar 2026 08:06:34 +0000 (+1030) Subject: block: reject zero length in bio_add_page() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=643893647cac7317bafca4040dd0cfb815b510d4;p=thirdparty%2Flinux.git block: reject zero length in bio_add_page() The function bio_add_page() returns the number of bytes added to the bio, and if that failed it should return 0. However there is a special quirk, if a caller is passing a page with length 0, that function will always return 0 but with different results: - The page is added to the bio If there is enough bvec slot or the folio can be merged with the last bvec. The return value 0 is just the length passed in, which is also 0. - The page is not added to the bio If the page is not mergeable with the last bvec, or there is no bvec slot available. The return value 0 means page is not added into the bio. Unfortunately the caller is not able to distinguish the above two cases, and will treat the 0 return value as page addition failure. In that case, this can lead to the double releasing of the last page: - By the bio cleanup Which normally goes through every page of the bio, including the last page which is added into the bio. - By the caller Which believes the page is not added into the bio, thus would manually release the page. I do not think anyone should call bio_add_folio()/bio_add_page() with zero length, but idiots like me can still show up. So add an extra WARN_ON_ONCE() check for zero length and rejects it early to avoid double freeing. Signed-off-by: Qu Wenruo Link: https://patch.msgid.link/bc2223c080f38d0b63f968f605c918181c840f40.1773734749.git.wqu@suse.com Signed-off-by: Jens Axboe --- diff --git a/block/bio.c b/block/bio.c index b58bce6b5feaa..5057047194c49 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1026,6 +1026,8 @@ int bio_add_page(struct bio *bio, struct page *page, { if (WARN_ON_ONCE(bio_flagged(bio, BIO_CLONED))) return 0; + if (WARN_ON_ONCE(len == 0)) + return 0; if (bio->bi_iter.bi_size > BIO_MAX_SIZE - len) return 0;