From: Ming Lei Date: Thu, 9 Apr 2026 13:30:13 +0000 (+0800) Subject: ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support X-Git-Tag: v7.1-rc1~233^2~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=23b3b6f0b584b70a427d5bb826d320151890d7da;p=thirdparty%2Fkernel%2Flinux.git ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support The __u32 len field cannot represent a 4GB buffer (0x100000000 overflows to 0). Change it to __u64 so buffers up to 4GB can be registered. Add a reserved field for alignment and validate it is zero. The kernel enforces a default max of 4GB (UBLK_SHMEM_BUF_SIZE_MAX) which may be increased in future. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-2-tom.leiming@gmail.com Signed-off-by: Jens Axboe --- diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 1af42850f5b10..3f8bb80b1e8f9 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -63,6 +63,9 @@ #define UBLK_CMD_REG_BUF _IOC_NR(UBLK_U_CMD_REG_BUF) #define UBLK_CMD_UNREG_BUF _IOC_NR(UBLK_U_CMD_UNREG_BUF) +/* Default max shmem buffer size: 4GB (may be increased in future) */ +#define UBLK_SHMEM_BUF_SIZE_MAX (1ULL << 32) + #define UBLK_IO_REGISTER_IO_BUF _IOC_NR(UBLK_U_IO_REGISTER_IO_BUF) #define UBLK_IO_UNREGISTER_IO_BUF _IOC_NR(UBLK_U_IO_UNREGISTER_IO_BUF) @@ -5351,11 +5354,15 @@ static int ublk_ctrl_reg_buf(struct ublk_device *ub, if (buf_reg.flags & ~UBLK_SHMEM_BUF_READ_ONLY) return -EINVAL; + if (buf_reg.reserved) + return -EINVAL; + addr = buf_reg.addr; size = buf_reg.len; nr_pages = size >> PAGE_SHIFT; - if (!size || !PAGE_ALIGNED(size) || !PAGE_ALIGNED(addr)) + if (!size || size > UBLK_SHMEM_BUF_SIZE_MAX || + !PAGE_ALIGNED(size) || !PAGE_ALIGNED(addr)) return -EINVAL; disk = ublk_get_disk(ub); diff --git a/include/uapi/linux/ublk_cmd.h b/include/uapi/linux/ublk_cmd.h index a7078b7987918..6991370a72ce6 100644 --- a/include/uapi/linux/ublk_cmd.h +++ b/include/uapi/linux/ublk_cmd.h @@ -89,8 +89,9 @@ /* Parameter buffer for UBLK_U_CMD_REG_BUF, pointed to by ctrl_cmd.addr */ struct ublk_shmem_buf_reg { __u64 addr; /* userspace virtual address of shared memory */ - __u32 len; /* buffer size in bytes (page-aligned, max 4GB) */ + __u64 len; /* buffer size in bytes, page-aligned, default max 4GB */ __u32 flags; + __u32 reserved; }; /* Pin pages without FOLL_WRITE; usable with write-sealed memfd */