Re: [PATCH RESEND 5/5] block: validate user space vectors during extraction

On Aug 06, 2026 / 16:29, 0wnerD1ed wrote:
> On Aug 06, 2026 / 16:04, Shin'ichiro Kawasaki wrote:
> > I took a closer look. I modified the test case to respect the dma alignment [*],
> > and now the test case passes. This approach looks working. Will post the change
> > as a formal patch for review.
> 
> Sorry for the slow reply, I have been busy lately.
> 
> Thanks for chasing this down. The test is mine and its assumption is
> wrong, not the kernel, src/bio-full-trim puts the destination at
> p + page_size - 1, and null_blk advertises dma_alignment = 1 since
> commit 3451cf34f51b ("null_blk: allow byte aligned memory offsets"),
> so iov_iter_extract_bvecs() now rejects that odd address before
> anything is extracted and bio_iov_iter_align_down() is never reached.
> That restores the behaviour we had until 5ff3f74e145a ("block:
> simplify direct io validity check"), so the test is what has to
> respect dma_alignment. Your approach is the right one.

Good, thanks for the confirmation.

> 
> One problem in the trial patch, the guard has to be against the
> logical block size, not the page size. What the test needs is a
> fragment that bio_iov_iter_align_down() removes completely, i.e. one
> smaller than the block size, and the read has to reach the PROT_NONE
> page. With dma_alignment = 511 and a 512 byte block size (the block
> layer default for drivers that do not set dma_alignment),
> dma_aligned_offset becomes 512, which is below page_size and passes
> the check, but the read then lies entirely within the first page,
> succeeds, and the helper reports
> 
>       pread returned 512 (errno 0)
> 
> instead of taking the "unexpected dma_alignment" exit. block/045 only
> uses null_blk so this cannot bite today, but the check does not do
> what it intends. block_size comes from BLKSSZGET, so it also has to
> move below that ioctl:
> 
>       if (dma_aligned_offset >= block_size)
>               errx(EXIT_FAILURE,
>                    "unexpected dma_alignment %u for block size %u",
>                    dma_alignment, block_size);
> 
> While there, err() should be errx(), errno is not meaningful at that
> point.

Yep, I reflected this change to the patch.

> 
> I am short on time at the moment, so please go ahead with the formal
> posting. I will send a Tested-by once I get a chance to run it.

Sure, I have posted the patch. Thanks.

https://lore.kernel.org/linux-block/[email protected]/