[PATCH] dm: pass origin bio's bdev to bio_alloc_clone

[PATCH] dm: pass origin bio's bdev to bio_alloc_clone

[Zhihao Cheng]

The origin bio carries blk-cgroup information which could be set from
foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't
control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to
bio_alloc_clone"). The synchronous io is still under control by blkcg,
because 'bio->bi_blkg' is set by io submitting task which has been
added into 'cgroup.procs'.

Fix it by passing origin bio's bdev to bio_alloc_clone.

Fetch a reproducer in [Link].

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985
Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
---
 drivers/md/dm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index b63279202260..e763e3b02a9f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -574,7 +574,8 @@ static struct dm_io *alloc_io(struct mapped_device *md, struct bio *bio, gfp_t g
 	struct dm_target_io *tio;
 	struct bio *clone;
 
-	clone = bio_alloc_clone(NULL, bio, gfp_mask, &md->mempools->io_bs);
+	clone = bio_alloc_clone(bio->bi_bdev, bio,
+				gfp_mask, &md->mempools->io_bs);
 	if (unlikely(!clone))
 		return NULL;
 	tio = clone_to_tio(clone);
@@ -623,7 +624,7 @@ static struct bio *alloc_tio(struct clone_info *ci, struct dm_target *ti,
 		/* alloc_io() already initialized embedded clone */
 		clone = &tio->clone;
 	} else {
-		clone = bio_alloc_clone(NULL, ci->bio, gfp_mask,
+		clone = bio_alloc_clone(ci->bio->bi_bdev, ci->bio, gfp_mask,
 					&md->mempools->bs);
 		if (!clone)
 			return NULL;
-- 
2.52.0

Re: [PATCH] dm: pass origin bio's bdev to bio_alloc_clone

[Zhihao Cheng]

在 2026/1/16 20:07, Zhihao Cheng 写道:

friendly ping

> The origin bio carries blk-cgroup information which could be set from
> foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't
> control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to
> bio_alloc_clone"). The synchronous io is still under control by blkcg,
> because 'bio->bi_blkg' is set by io submitting task which has been
> added into 'cgroup.procs'.
> 
> Fix it by passing origin bio's bdev to bio_alloc_clone.
> 
> Fetch a reproducer in [Link].
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985
> Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
> Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
> ---
>   drivers/md/dm.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index b63279202260..e763e3b02a9f 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -574,7 +574,8 @@ static struct dm_io *alloc_io(struct mapped_device *md, struct bio *bio, gfp_t g
>   	struct dm_target_io *tio;
>   	struct bio *clone;
>   
> -	clone = bio_alloc_clone(NULL, bio, gfp_mask, &md->mempools->io_bs);
> +	clone = bio_alloc_clone(bio->bi_bdev, bio,
> +				gfp_mask, &md->mempools->io_bs);
>   	if (unlikely(!clone))
>   		return NULL;
>   	tio = clone_to_tio(clone);
> @@ -623,7 +624,7 @@ static struct bio *alloc_tio(struct clone_info *ci, struct dm_target *ti,
>   		/* alloc_io() already initialized embedded clone */
>   		clone = &tio->clone;
>   	} else {
> -		clone = bio_alloc_clone(NULL, ci->bio, gfp_mask,
> +		clone = bio_alloc_clone(ci->bio->bi_bdev, ci->bio, gfp_mask,
>   					&md->mempools->bs);
>   		if (!clone)
>   			return NULL;
> 

Re: [PATCH] dm: pass origin bio's bdev to bio_alloc_clone

[Mikulas Patocka]

[-- Attachment #1: Type: text/plain, Size: 1626 bytes --]



On Fri, 23 Jan 2026, Zhihao Cheng wrote:

> 在 2026/1/16 20:07, Zhihao Cheng 写道:
> 
> friendly ping

Hi

I find it quite hacky to set bi_bdev and overwrite it later. I came up 
with this patch that clones the control group association explictely, it 
fixes your testcase. Please test it and report if it works for you.

Mikulas


dm: use bio_clone_blkg_association

The origin bio carries blk-cgroup information which could be set from
foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't
control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to
bio_alloc_clone"). The synchronous io is still under control by blkcg,
because 'bio->bi_blkg' is set by io submitting task which has been added
into 'cgroup.procs'.

Fix it by using bio_clone_blkg_association when submitting a cloned bio.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985
Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
Reported-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

---
 drivers/md/dm.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux-2.6/drivers/md/dm.c
===================================================================
--- linux-2.6.orig/drivers/md/dm.c	2026-01-06 15:55:41.000000000 +0100
+++ linux-2.6/drivers/md/dm.c	2026-01-23 17:07:50.000000000 +0100
@@ -1364,6 +1364,8 @@ void dm_submit_bio_remap(struct bio *clo
 	if (!tgt_clone)
 		tgt_clone = clone;
 
+	bio_clone_blkg_association(tgt_clone, io->orig_bio);
+
 	/*
 	 * Account io->origin_bio to DM dev on behalf of target
 	 * that took ownership of IO with DM_MAPIO_SUBMITTED.

Re: [PATCH] dm: pass origin bio's bdev to bio_alloc_clone

[Zhihao Cheng]

在 2026/1/24 0:16, Mikulas Patocka 写道:
> 
> 
> On Fri, 23 Jan 2026, Zhihao Cheng wrote:
> 
>> 在 2026/1/16 20:07, Zhihao Cheng 写道:
>>
>> friendly ping
> 
> Hi
> 
> I find it quite hacky to set bi_bdev and overwrite it later. I came up
> with this patch that clones the control group association explictely, it
> fixes your testcase. Please test it and report if it works for you.
> 
> Mikulas
> 

Thanks for the patch, it works.

Tested-by: Zhihao Cheng <chengzhihao1@huawei.com>

> 
> dm: use bio_clone_blkg_association
> 
> The origin bio carries blk-cgroup information which could be set from
> foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't
> control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to
> bio_alloc_clone"). The synchronous io is still under control by blkcg,
> because 'bio->bi_blkg' is set by io submitting task which has been added
> into 'cgroup.procs'.
> 
> Fix it by using bio_clone_blkg_association when submitting a cloned bio.
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985
> Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
> Reported-by: Zhihao Cheng <chengzhihao1@huawei.com>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> 
> ---
>   drivers/md/dm.c |    2 ++
>   1 file changed, 2 insertions(+)
> 
> Index: linux-2.6/drivers/md/dm.c
> ===================================================================
> --- linux-2.6.orig/drivers/md/dm.c	2026-01-06 15:55:41.000000000 +0100
> +++ linux-2.6/drivers/md/dm.c	2026-01-23 17:07:50.000000000 +0100
> @@ -1364,6 +1364,8 @@ void dm_submit_bio_remap(struct bio *clo
>   	if (!tgt_clone)
>   		tgt_clone = clone;
>   
> +	bio_clone_blkg_association(tgt_clone, io->orig_bio);
> +
>   	/*
>   	 * Account io->origin_bio to DM dev on behalf of target
>   	 * that took ownership of IO with DM_MAPIO_SUBMITTED.
>