From: Ming Lei Date: Thu, 9 Apr 2026 13:30:14 +0000 (+0800) Subject: ublk: verify all pages in multi-page bvec fall within registered range X-Git-Tag: v7.1-rc1~233^2~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=211ff1602b67e26125977f8b2f369d7c2847628c;p=thirdparty%2Fkernel%2Flinux.git ublk: verify all pages in multi-page bvec fall within registered range rq_for_each_bvec() yields multi-page bvecs where bv_page is only the first page. ublk_try_buf_match() only validated the start PFN against the maple tree, but a bvec can span multiple pages past the end of a registered range. Use mas_walk() instead of mtree_load() to obtain the range boundaries stored in the maple tree, and check that the bvec's end PFN does not exceed the range. Also remove base_pfn from struct ublk_buf_range since mas.index already provides the range start PFN. Reported-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-3-tom.leiming@gmail.com Signed-off-by: Jens Axboe --- diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 3f8bb80b1e8f9..8fef6dfee271a 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -304,7 +304,6 @@ struct ublk_buf { /* Maple tree value: maps a PFN range to buffer location */ struct ublk_buf_range { - unsigned long base_pfn; unsigned short buf_index; unsigned short flags; unsigned int base_offset; /* byte offset within buffer */ @@ -5306,7 +5305,6 @@ static int __ublk_ctrl_reg_buf(struct ublk_device *ub, } range->buf_index = index; range->flags = flags; - range->base_pfn = pfn; range->base_offset = start << PAGE_SHIFT; ret = mtree_insert_range(&ub->buf_tree, pfn, @@ -5451,8 +5449,8 @@ static void __ublk_ctrl_unreg_buf(struct ublk_device *ub, if (range->buf_index != buf_index) continue; - base = range->base_pfn; - nr = mas.last - mas.index + 1; + base = mas.index; + nr = mas.last - base + 1; mas_erase(&mas); for (off = 0; off < nr; ) { @@ -5531,15 +5529,22 @@ static bool ublk_try_buf_match(struct ublk_device *ub, rq_for_each_bvec(bv, rq, iter) { unsigned long pfn = page_to_pfn(bv.bv_page); + unsigned long end_pfn = pfn + + ((bv.bv_offset + bv.bv_len - 1) >> PAGE_SHIFT); struct ublk_buf_range *range; unsigned long off; + MA_STATE(mas, &ub->buf_tree, pfn, pfn); - range = mtree_load(&ub->buf_tree, pfn); + range = mas_walk(&mas); if (!range) return false; + /* verify all pages in this bvec fall within the range */ + if (end_pfn > mas.last) + return false; + off = range->base_offset + - (pfn - range->base_pfn) * PAGE_SIZE + bv.bv_offset; + (pfn - mas.index) * PAGE_SIZE + bv.bv_offset; if (first) { /* Read-only buffer can't serve READ (kernel writes) */