Re: [PATCH next] block: mempool alloc fail due to insufficient memory

[Jens Axboe]

On 3/21/26 2:36 AM, Edward Adam Davis wrote:
> Add a failure check for mempool_alloc() in the slowpath.
> 
> [1]
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> Workqueue: writeback wb_workfn (flush-8:0)
> RIP: 0010:bio_init block/bio.c:214 [inline]
> RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline]
> RIP: 0010:bio_alloc_bioset+0x664/0xc10 block/bio.c:593
> Call Trace:
>  bio_alloc include/linux/bio.h:373 [inline]
>  submit_bh_wbc+0x22d/0x650 fs/buffer.c:2816
> 
> Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath")
> Reported-by: syzbot+09ddb593eea76a158f42@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=09ddb593eea76a158f42
> Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
> ---
>  block/bio.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/block/bio.c b/block/bio.c
> index 5057047194c4..0a870979bd41 100644
> --- a/block/bio.c
> +++ b/block/bio.c
> @@ -582,6 +582,9 @@ struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs,
>  		opf &= ~REQ_ALLOC_CACHE;
>  
>  		p = mempool_alloc(&bs->bio_pool, gfp);
> +		if (unlikely(!p))
> +			return NULL;
> +

Doesn't look right at all. You dropped the backtrace, which shows this is
off __block_write_full_folio() -> submit_bh_wbc() which allocates a bio
from the mempool with GFP_NOIO. That should allow blocking, and hence
mempool_alloc() should NEVER return NULL for that case. If it does,
it's broken, and your change is just papering around that issue.

-- 
Jens Axboe