[PATCH] ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation

[PATCH] ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation

[Ming Lei]

blk_validate_limits() requires max_hw_sectors >= PAGE_SECTORS and fires
a WARN_ON_ONCE if this invariant is violated. ublk_validate_params()
only checked the upper bound of max_sectors against max_io_buf_bytes,
allowing userspace to pass small values (including zero) that trigger
the warning when blk_mq_alloc_disk() is called from
ublk_ctrl_start_dev().

Before 494ea040bcb5, ublk used blk_queue_max_hw_sectors() which silently
clamped small values up to PAGE_SECTORS. The conversion to passing
queue_limits directly to blk_mq_alloc_disk() lost that clamping and now
hits blk_validate_limits()'s WARN_ON_ONCE instead.

Validate that max_sectors is at least PAGE_SECTORS in
ublk_validate_params() so invalid values are rejected early with
-EINVAL instead of reaching the block layer.

Fixes: 494ea040bcb5 ("ublk: pass queue_limits to blk_mq_alloc_disk")
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
---
 drivers/block/ublk_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 6d13f1481de0..6c041eaebdb9 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -920,6 +920,9 @@ static int ublk_validate_params(const struct ublk_device *ub)
 		if (p->max_sectors > (ub->dev_info.max_io_buf_bytes >> 9))
 			return -EINVAL;
 
+		if (p->max_sectors < PAGE_SECTORS)
+			return -EINVAL;
+
 		if (ublk_dev_is_zoned(ub) && !p->chunk_sectors)
 			return -EINVAL;
 	} else
-- 
2.53.0

Re: [PATCH] ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation

[Jens Axboe]

On Sun, 10 May 2026 22:48:43 +0800, Ming Lei wrote:
> blk_validate_limits() requires max_hw_sectors >= PAGE_SECTORS and fires
> a WARN_ON_ONCE if this invariant is violated. ublk_validate_params()
> only checked the upper bound of max_sectors against max_io_buf_bytes,
> allowing userspace to pass small values (including zero) that trigger
> the warning when blk_mq_alloc_disk() is called from
> ublk_ctrl_start_dev().
> 
> [...]

Applied, thanks!

[1/1] ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
      commit: 1860c2f85922917d8a46f16a6f4bd2298ffa0fb5

Best regards,
-- 
Jens Axboe