]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ublk: use unchecked copy helpers for bio page data
authorMing Lei <ming.lei@redhat.com>
Wed, 15 Apr 2026 23:02:46 +0000 (07:02 +0800)
committerJens Axboe <axboe@kernel.dk>
Fri, 17 Apr 2026 20:36:15 +0000 (14:36 -0600)
commita7c9fa7f6601c84d27cdd43bd96e8fcbacfb7479
tree1f3ce072f4c22c80f79b86555359f7f68ea44a75
parent2f5015461984caa8ebf265a60b22f38c94d9c70a
ublk: use unchecked copy helpers for bio page data

Bio pages may originate from slab caches that lack a usercopy region
(e.g. jbd2 frozen metadata buffers allocated via jbd2_alloc()).
When CONFIG_HARDENED_USERCOPY is enabled, copy_to_iter() calls
check_copy_size() which rejects these slab pages, triggering a
kernel BUG in usercopy_abort().

This is a false positive: the data is ordinary block I/O content —
the same data the loop driver writes to its backing file via
vfs_iter_write().  The bvec length is always trusted, so the size
check in check_copy_size() is not needed either.

Switch to _copy_to_iter()/_copy_from_iter() which skip the
check_copy_size() wrapper while the underlying copy_to_user()
remains unchanged.

Acked-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 2299ceec364e ("ublk: use copy_{to,from}_iter() for user copy")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://patch.msgid.link/20260415230246.808176-1-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/ublk_drv.c