Commit 211ff160 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

ublk: verify all pages in multi-page bvec fall within registered range 



rq_for_each_bvec() yields multi-page bvecs where bv_page is only the
first page. ublk_try_buf_match() only validated the start PFN against
the maple tree, but a bvec can span multiple pages past the end of a
registered range.

Use mas_walk() instead of mtree_load() to obtain the range boundaries
stored in the maple tree, and check that the bvec's end PFN does not
exceed the range. Also remove base_pfn from struct ublk_buf_range
since mas.index already provides the range start PFN.

Reported-by: default avatarCaleb Sander Mateos <csander@purestorage.com>
Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260409133020.3780098-3-tom.leiming@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 23b3b6f0

drivers/block/ublk_drv.c

+11 −6
Original line number Diff line number Diff line
@@ -304,7 +304,6 @@ struct ublk_buf { 


/* Maple tree value: maps a PFN range to buffer location */

struct ublk_buf_range {

	unsigned long base_pfn;

	unsigned short buf_index;

	unsigned short flags;

	unsigned int base_offset;	/* byte offset within buffer */
@@ -5306,7 +5305,6 @@ static int __ublk_ctrl_reg_buf(struct ublk_device *ub, 
		}

		range->buf_index = index;

		range->flags = flags;

		range->base_pfn = pfn;

		range->base_offset = start << PAGE_SHIFT;



		ret = mtree_insert_range(&ub->buf_tree, pfn,
@@ -5451,8 +5449,8 @@ static void __ublk_ctrl_unreg_buf(struct ublk_device *ub, 
		if (range->buf_index != buf_index)

			continue;



		base = range->base_pfn;

		nr = mas.last - mas.index + 1;

		base = mas.index;

		nr = mas.last - base + 1;

		mas_erase(&mas);



		for (off = 0; off < nr; ) {
@@ -5531,15 +5529,22 @@ static bool ublk_try_buf_match(struct ublk_device *ub, 


	rq_for_each_bvec(bv, rq, iter) {

		unsigned long pfn = page_to_pfn(bv.bv_page);

		unsigned long end_pfn = pfn +

			((bv.bv_offset + bv.bv_len - 1) >> PAGE_SHIFT);

		struct ublk_buf_range *range;

		unsigned long off;

		MA_STATE(mas, &ub->buf_tree, pfn, pfn);



		range = mtree_load(&ub->buf_tree, pfn);

		range = mas_walk(&mas);

		if (!range)

			return false;



		/* verify all pages in this bvec fall within the range */

		if (end_pfn > mas.last)

			return false;



		off = range->base_offset +

			(pfn - range->base_pfn) * PAGE_SIZE + bv.bv_offset;

			(pfn - mas.index) * PAGE_SIZE + bv.bv_offset;



		if (first) {

			/* Read-only buffer can't serve READ (kernel writes) */