zram: introduce writeback bio batching support

Hello Yuwen Chen,

Commit 01516d2d32bf ("zram: introduce writeback bio batching support") from Nov 13, 2025 (linux-next), leads to the following Smatch static checker warning:

drivers/block/zram/zram_drv.c:1284 writeback_store()
error: we previously assumed 'wb_ctl' could be null (see line 1211)

drivers/block/zram/zram_drv.c

    1174 static ssize_t writeback_store(struct device *dev,
    1175                                struct device_attribute *attr,
    1176                                const char *buf, size_t len)
    1177 {
    1178         struct zram *zram = dev_to_zram(dev);
    1179         u64 nr_pages = zram->disksize >> PAGE_SHIFT;
    1180         unsigned long lo = 0, hi = nr_pages;
    1181         struct zram_pp_ctl *pp_ctl = NULL;
    1182         struct zram_wb_ctl *wb_ctl = NULL;
    1183         char *args, *param, *val;
    1184         ssize_t ret = len;
    1185         int err, mode = 0;
    1186 
    1187         down_read(&zram->init_lock);
    1188         if (!init_done(zram)) {
    1189                 up_read(&zram->init_lock);
    1190                 return -EINVAL;
    1191         }
    1192 
    1193         /* Do not permit concurrent post-processing actions. */
    1194         if (atomic_xchg(&zram->pp_in_progress, 1)) {
    1195                 up_read(&zram->init_lock);
    1196                 return -EAGAIN;
    1197         }
    1198 
    1199         if (!zram->backing_dev) {
    1200                 ret = -ENODEV;
    1201                 goto release_init_lock;

wb_ctl is NULL.

    1202         }
    1203 
    1204         pp_ctl = init_pp_ctl();
    1205         if (!pp_ctl) {
    1206                 ret = -ENOMEM;
    1207                 goto release_init_lock;
    1208         }
    1209 
    1210         wb_ctl = init_wb_ctl(zram);
    1211         if (!wb_ctl) {
    1212                 ret = -ENOMEM;
    1213                 goto release_init_lock;
    1214         }
    1215 
    1216         args = skip_spaces(buf);
    1217         while (*args) {
    1218                 args = next_arg(args, &param, &val);
    1219 
    1220                 /*
    1221                  * Workaround to support the old writeback interface.
    1222                  *
    1223                  * The old writeback interface has a minor inconsistency and
    1224                  * requires key=value only for page_index parameter, while the
    1225                  * writeback mode is a valueless parameter.
    1226                  *
    1227                  * This is not the case anymore and now all parameters are
    1228                  * required to have values, however, we need to support the
    1229                  * legacy writeback interface format so we check if we can
    1230                  * recognize a valueless parameter as the (legacy) writeback
    1231                  * mode.
    1232                  */
    1233                 if (!val || !*val) {
    1234                         err = parse_mode(param, &mode);
    1235                         if (err) {
    1236                                 ret = err;
    1237                                 goto release_init_lock;
    1238                         }
    1239 
    1240                         scan_slots_for_writeback(zram, mode, lo, hi, pp_ctl);
    1241                         break;
    1242                 }
    1243 
    1244                 if (!strcmp(param, "type")) {
    1245                         err = parse_mode(val, &mode);
    1246                         if (err) {
    1247                                 ret = err;
    1248                                 goto release_init_lock;
    1249                         }
    1250 
    1251                         scan_slots_for_writeback(zram, mode, lo, hi, pp_ctl);
    1252                         break;
    1253                 }
    1254 
    1255                 if (!strcmp(param, "page_index")) {
    1256                         err = parse_page_index(val, nr_pages, &lo, &hi);
    1257                         if (err) {
    1258                                 ret = err;
    1259                                 goto release_init_lock;
    1260                         }
    1261 
    1262                         scan_slots_for_writeback(zram, mode, lo, hi, pp_ctl);
    1263                         continue;
    1264                 }
    1265 
    1266                 if (!strcmp(param, "page_indexes")) {
    1267                         err = parse_page_indexes(val, nr_pages, &lo, &hi);
    1268                         if (err) {
    1269                                 ret = err;
    1270                                 goto release_init_lock;
    1271                         }
    1272 
    1273                         scan_slots_for_writeback(zram, mode, lo, hi, pp_ctl);
    1274                         continue;
    1275                 }
    1276         }
    1277 
    1278         err = zram_writeback_slots(zram, pp_ctl, wb_ctl);
    1279         if (err)
    1280                 ret = err;
    1281 
    1282 release_init_lock:
    1283         release_pp_ctl(zram, pp_ctl);
--> 1284         release_wb_ctl(wb_ctl);
                                ^^^^^^

Dead.

    1285         atomic_set(&zram->pp_in_progress, 0);
    1286         up_read(&zram->init_lock);
    1287 
    1288         return ret;
    1289 }

regards,
dan carpenter

Thank you very much. It's a very obvious mistake.

regards,

Hello Sergey Senozhatsky:

Regarding this issue, do I need to submit a patch for correction or resubmit the following series of patches?

https://lore.kernel.org/all/[email protected]/

Thinks

index fff9e45..30c7636 100644
@@ -818,6 +818,9 @@ static void release_wb_req(struct zram_wb_req *req)
 
 static void release_wb_ctl(struct zram_wb_ctl *wb_ctl)
 {
+       if (!wb_ctl)
+               return;
+
        /* We should never have inflight requests at this point */
        WARN_ON(!list_empty(&wb_ctl->inflight_reqs));
 

No, that's a simple fix for a patch that is in akpm's tree, I'll just send a fixup to Andrew. Dan, thanks for reporting it.