Add a failure check for mempool_alloc() in the slowpath. [1] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: writeback wb_workfn (flush-8:0) RIP: 0010:bio_init block/bio.c:214 [inline] RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline] RIP: 0010:bio_alloc_bioset+0x664/0xc10 block/bio.c:593 Call Trace: bio_alloc include/linux/bio.h:373 [inline] submit_bh_wbc+0x22d/0x650 fs/buffer.c:2816 Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Reported-by: syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=09ddb593eea76a158f42 Signed-off-by: Edward Adam Davis --- block/bio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/bio.c b/block/bio.c index 5057047194c4..0a870979bd41 100644 --- a/block/bio.c +++ b/block/bio.c @@ -582,6 +582,9 @@ struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs, opf &= ~REQ_ALLOC_CACHE; p = mempool_alloc(&bs->bio_pool, gfp); + if (unlikely(!p)) + return NULL; + bio = p + bs->front_pad; if (nr_vecs > BIO_INLINE_VECS) { nr_vecs = BIO_MAX_VECS; -- 2.43.0