mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 15:43:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

ublk: check import_ubuf() return value

Browse Source 
import_ubuf() can fail if the address range (provided by the userspace
ublk server) is outside the allowed user address space. Return that 0
bytes were copied if import_ubuf() fails rather than passing an
uninitialized struct iov_iter to ublk_copy_user_pages().

Fixes: 981f95a571 ("ublk: cleanup ublk_copy_user_pages")
Reported-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Link: https://patch.msgid.link/20260729171041.45061-2-csander@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Caleb Sander Mateos
2026-07-29 11:10:39 -06:00
committed by Jens Axboe
parent cbe81d6120
commit 3831568792
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/block/ublk_drv.c
View File

@@ -1475,7 +1475,10 @@ static unsigned int ublk_map_io(const struct ublk_queue *ubq,
struct iov_iter iter;
const int dir = ITER_DEST;
import_ubuf(dir, u64_to_user_ptr(io->buf.addr), rq_bytes, &iter);
if (import_ubuf(dir, u64_to_user_ptr(io->buf.addr), rq_bytes,
&iter) < 0)
return 0;
return ublk_copy_user_pages(req, 0, &iter, dir);
}
return rq_bytes;
@@ -1496,7 +1499,10 @@ static unsigned int ublk_unmap_io(bool need_map,
WARN_ON_ONCE(io->res > rq_bytes);
import_ubuf(dir, u64_to_user_ptr(io->buf.addr), io->res, &iter);
if (import_ubuf(dir, u64_to_user_ptr(io->buf.addr), io->res,
&iter) < 0)
return 0;
return ublk_copy_user_pages(req, 0, &iter, dir);
}
return rq_bytes;