Since the dawn of time bio_check_eod has a check for a non-zero size of the device. This doesn't really make any sense as we never want to send I/O to a device that's been set to zero size, or never moved out of that. I am a bit surprised we haven't caught this for a long time, but the removal of the extra validation inside of zram caused syzbot to trip over this issue recently. I've added a Fixes tag for that commit, but the issue really goes back way before git history.
Unified · Split
| @@ -520,7 +520,7 @@ static inline int bio_check_eod(struct bio *bio) · 519 unmodified lines | |||
| 520 | sector_t maxsector = bdev_nr_sectors(bio->bi_bdev); | 520 | sector_t maxsector = bdev_nr_sectors(bio->bi_bdev); |
| 521 | unsigned int nr_sectors = bio_sectors(bio); | 521 | unsigned int nr_sectors = bio_sectors(bio); |
| 522 | 522 | ||
| 523 | if (nr_sectors && maxsector && | 523 | if (nr_sectors && |
| 524 | (nr_sectors > maxsector || | 524 | (nr_sectors > maxsector || |
| 525 | bio->bi_iter.bi_sector > maxsector - nr_sectors)) { | 525 | bio->bi_iter.bi_sector > maxsector - nr_sectors)) { |
| 526 | pr_info_ratelimited("%s: attempt to access beyond end of device\n" | 526 | pr_info_ratelimited("%s: attempt to access beyond end of device\n" |