[PATCH 1/7] ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support

Ming Lei
2026-04-09T13:30:39Z

The __u32 len field cannot represent a 4GB buffer (0x100000000
overflows to 0). Change it to __u64 so buffers up to 4GB can be
registered. Add a reserved field for alignment and validate it
is zero.

The kernel enforces a default max of 4GB (UBLK_SHMEM_BUF_SIZE_MAX)
which may be increased in future.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
---
drivers/block/ublk_drv.c | 9 ++++++++-
include/uapi/linux/ublk_cmd.h | 3 ++-
2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 2e475bdc54dd..ada9a2e32ea9 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -63,6 +63,9 @@
#define UBLK_CMD_REG_BUF _IOC_NR(UBLK_U_CMD_REG_BUF)
#define UBLK_CMD_UNREG_BUF _IOC_NR(UBLK_U_CMD_UNREG_BUF)

+/* Default max shmem buffer size: 4GB (may be increased in future) */
+#define UBLK_SHMEM_BUF_SIZE_MAX (1ULL << 32)
+
#define UBLK_IO_REGISTER_IO_BUF _IOC_NR(UBLK_U_IO_REGISTER_IO_BUF)
#define UBLK_IO_UNREGISTER_IO_BUF _IOC_NR(UBLK_U_IO_UNREGISTER_IO_BUF)

@@ -5351,11 +5354,15 @@ static int ublk_ctrl_reg_buf(struct ublk_device *ub,
if (buf_reg.flags & ~UBLK_SHMEM_BUF_READ_ONLY)
return -EINVAL;

+ if (buf_reg.reserved)
+ return -EINVAL;
+
addr = buf_reg.addr;
size = buf_reg.len;
nr_pages = size >> PAGE_SHIFT;

- if (!size || !PAGE_ALIGNED(size) || !PAGE_ALIGNED(addr))
+ if (!size || size > UBLK_SHMEM_BUF_SIZE_MAX ||
+ !PAGE_ALIGNED(size) || !PAGE_ALIGNED(addr))
return -EINVAL;

disk = ublk_get_disk(ub);
diff --git a/include/uapi/linux/ublk_cmd.h b/include/uapi/linux/ublk_cmd.h
index ecd258847d3d..66d93efccd51 100644
--- a/include/uapi/linux/ublk_cmd.h
+++ b/include/uapi/linux/ublk_cmd.h
@@ -89,8 +89,9 @@
/* Parameter buffer for UBLK_U_CMD_REG_BUF, pointed to by ctrl_cmd.addr */
struct ublk_shmem_buf_reg {
__u64 addr; /* userspace virtual address of shared memory */
- __u32 len; /* buffer size in bytes (page-aligned, max 4GB) */
+ __u64 len; /* buffer size in bytes, page-aligned, default max 4GB */
__u32 flags;
+ __u32 reserved;
};

/* Pin pages without FOLL_WRITE; usable with write-sealed memfd */
--
2.53.0