Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ublk: verify all pages in multi-page bvec fall within registered range

Browse source 
rq_for_each_bvec() yields multi-page bvecs where bv_page is only the
first page. ublk_try_buf_match() only validated the start PFN against
the maple tree, but a bvec can span multiple pages past the end of a
registered range.

Use mas_walk() instead of mtree_load() to obtain the range boundaries
stored in the maple tree, and check that the bvec's end PFN does not
exceed the range. Also remove base_pfn from struct ublk_buf_range
since mas.index already provides the range start PFN.

Reported-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260409133020.3780098-3-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Ming Lei 2026-04-09 21:30:14 +08:00 • committed by Jens Axboe
commit 211ff1602b
1 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
drivers/block/ublk_drv.c
View file

@ -304,7 +304,6 @@ struct ublk_buf {
/* Maple tree value: maps a PFN range to buffer location */
struct ublk_buf_range {
unsigned long base_pfn;
unsigned short buf_index;
unsigned short flags;
unsigned int base_offset; /* byte offset within buffer */
@ -5306,7 +5305,6 @@ static int __ublk_ctrl_reg_buf(struct ublk_device *ub,
}
range->buf_index = index;
range->flags = flags;
range->base_pfn = pfn;
range->base_offset = start << PAGE_SHIFT;
ret = mtree_insert_range(&ub->buf_tree, pfn,
@ -5451,8 +5449,8 @@ static void __ublk_ctrl_unreg_buf(struct ublk_device *ub,
if (range->buf_index != buf_index)
continue;
base = range->base_pfn;
nr = mas.last - mas.index + 1;
base = mas.index;
nr = mas.last - base + 1;
mas_erase(&mas);
for (off = 0; off < nr; ) {
@ -5531,15 +5529,22 @@ static bool ublk_try_buf_match(struct ublk_device *ub,
rq_for_each_bvec(bv, rq, iter) {
unsigned long pfn = page_to_pfn(bv.bv_page);
unsigned long end_pfn = pfn +
((bv.bv_offset + bv.bv_len - 1) >> PAGE_SHIFT);
struct ublk_buf_range *range;
unsigned long off;
MA_STATE(mas, &ub->buf_tree, pfn, pfn);
range = mtree_load(&ub->buf_tree, pfn);
range = mas_walk(&mas);
if (!range)
return false;
/* verify all pages in this bvec fall within the range */
if (end_pfn > mas.last)
return false;
off = range->base_offset +
(pfn - range->base_pfn) * PAGE_SIZE + bv.bv_offset;
(pfn - mas.index) * PAGE_SIZE + bv.bv_offset;
if (first) {
/* Read-only buffer can't serve READ (kernel writes) */