This is a note to let you know that I've just added the patch titled block: handle bio_split_to_limits() NULL return to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: block-handle-bio_split_to_limits-null-return.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 613b14884b8595e20b9fac4126bf627313827fbe Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Wed, 4 Jan 2023 08:51:19 -0700 Subject: block: handle bio_split_to_limits() NULL return From: Jens Axboe <axboe@xxxxxxxxx> commit 613b14884b8595e20b9fac4126bf627313827fbe upstream. This can't happen right now, but in preparation for allowing bio_split_to_limits() returning NULL if it ended the bio, check for it in all the callers. Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- block/blk-merge.c | 4 +++- block/blk-mq.c | 2 ++ drivers/block/drbd/drbd_req.c | 2 ++ drivers/block/pktcdvd.c | 2 ++ drivers/block/ps3vram.c | 2 ++ drivers/block/rsxx/dev.c | 2 ++ drivers/md/md.c | 2 ++ drivers/nvme/host/multipath.c | 2 ++ drivers/s390/block/dcssblk.c | 2 ++ 9 files changed, 19 insertions(+), 1 deletion(-) --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -348,11 +348,13 @@ void __blk_queue_split(struct bio **bio, break; } split = blk_bio_segment_split(q, *bio, &q->bio_split, nr_segs); + if (IS_ERR(split)) + *bio = split = NULL; break; } if (split) { - /* there isn't chance to merge the splitted bio */ + /* there isn't chance to merge the split bio */ split->bi_opf |= REQ_NOMERGE; bio_chain(split, *bio); --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2193,6 +2193,8 @@ blk_qc_t blk_mq_submit_bio(struct bio *b blk_queue_bounce(q, &bio); __blk_queue_split(&bio, &nr_segs); + if (!bio) + goto queue_exit; if (!bio_integrity_prep(bio)) goto queue_exit; --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -1602,6 +1602,8 @@ blk_qc_t drbd_submit_bio(struct bio *bio struct drbd_device *device = bio->bi_bdev->bd_disk->private_data; blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; /* * what we "blindly" assume: --- a/drivers/block/pktcdvd.c +++ b/drivers/block/pktcdvd.c @@ -2407,6 +2407,8 @@ static blk_qc_t pkt_submit_bio(struct bi struct bio *split; blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; pd = bio->bi_bdev->bd_disk->queue->queuedata; if (!pd) { --- a/drivers/block/ps3vram.c +++ b/drivers/block/ps3vram.c @@ -587,6 +587,8 @@ static blk_qc_t ps3vram_submit_bio(struc dev_dbg(&dev->core, "%s\n", __func__); blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; spin_lock_irq(&priv->lock); busy = !bio_list_empty(&priv->list); --- a/drivers/block/rsxx/dev.c +++ b/drivers/block/rsxx/dev.c @@ -127,6 +127,8 @@ static blk_qc_t rsxx_submit_bio(struct b blk_status_t st = BLK_STS_IOERR; blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; might_sleep(); --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -458,6 +458,8 @@ static blk_qc_t md_submit_bio(struct bio } blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; if (mddev->ro == 1 && unlikely(rw == WRITE)) { if (bio_sectors(bio) != 0) --- a/drivers/nvme/host/multipath.c +++ b/drivers/nvme/host/multipath.c @@ -329,6 +329,8 @@ static blk_qc_t nvme_ns_head_submit_bio( * pool from the original queue to allocate the bvecs from. */ blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; srcu_idx = srcu_read_lock(&head->srcu); ns = nvme_find_path(head); --- a/drivers/s390/block/dcssblk.c +++ b/drivers/s390/block/dcssblk.c @@ -866,6 +866,8 @@ dcssblk_submit_bio(struct bio *bio) unsigned long bytes_done; blk_queue_split(&bio); + if (!bio) + return BLK_QC_T_NONE; bytes_done = 0; dev_info = bio->bi_bdev->bd_disk->private_data; Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.15/block-handle-bio_split_to_limits-null-return.patch queue-5.15/io_uring-io-wq-only-free-worker-if-it-was-allocated-for-creation.patch queue-5.15/io_uring-lock-overflowing-for-iopoll.patch queue-5.15/io_uring-io-wq-free-worker-if-task_work-creation-is-canceled.patch