On 4/24/21 10:30 PM, Bart Van Assche wrote: > bio_max_size() may get called before device_add_disk() and hence needs to > check whether or not the block device pointer is NULL. Additionally, more > code needs to be modified than __bio_try_merge_page() to limit the bio size > to bio_max_size(). > > This patch prevents that bio_max_size() triggers the following kernel > crash during a SCSI LUN scan: > > BUG: KASAN: null-ptr-deref in bio_add_hw_page+0xa6/0x310 > Read of size 8 at addr 00000000000005a8 by task kworker/u16:0/7 > Workqueue: events_unbound async_run_entry_fn > Call Trace: > show_stack+0x52/0x58 > dump_stack+0x9d/0xcf > kasan_report.cold+0x4b/0x50 > __asan_load8+0x69/0x90 > bio_add_hw_page+0xa6/0x310 > bio_add_pc_page+0xaa/0xe0 > bio_map_kern+0xdc/0x1a0 > blk_rq_map_kern+0xcd/0x2d0 > __scsi_execute+0x9a/0x290 [scsi_mod] > scsi_probe_lun.constprop.0+0x17c/0x660 [scsi_mod] > scsi_probe_and_add_lun+0x178/0x750 [scsi_mod] > __scsi_add_device+0x18c/0x1a0 [scsi_mod] > ata_scsi_scan_host+0xe5/0x260 [libata] > async_port_probe+0x94/0xb0 [libata] > async_run_entry_fn+0x7d/0x2d0 > process_one_work+0x582/0xac0 > worker_thread+0x8f/0x5a0 > kthread+0x222/0x250 > ret_from_fork+0x1f/0x30 > > This patch also fixes the following kernel warning: > > WARNING: CPU: 1 PID: 15449 at block/bio.c:1034 > __bio_iov_iter_get_pages+0x324/0x350 > Call Trace: > bio_iov_iter_get_pages+0x6c/0x360 > __blkdev_direct_IO_simple+0x291/0x580 > blkdev_direct_IO+0xb5/0xc0 > generic_file_direct_write+0x10d/0x290 > __generic_file_write_iter+0x120/0x290 > blkdev_write_iter+0x16e/0x280 > new_sync_write+0x268/0x380 > vfs_write+0x3e0/0x4f0 > ksys_write+0xd9/0x180 > __x64_sys_write+0x43/0x50 > do_syscall_64+0x32/0x80 > entry_SYSCALL_64_after_hwframe+0x44/0xae Since I had to shuffle patches anyway, I folded in this fix. Thanks Bart. -- Jens Axboe
