[PATCH] selftests: ublk: fix user_data truncation for tgt_data >= 256

[PATCH] selftests: ublk: fix user_data truncation for tgt_data >= 256

[Ming Lei]

The build_user_data() function packs multiple fields into a __u64
value using bit shifts. Without explicit __u64 casts before shifting,
the shift operations are performed on 32-bit unsigned integers before
being promoted to 64-bit, causing data loss.

Specifically, when tgt_data >= 256, the expression (tgt_data << 24)
shifts on a 32-bit value, truncating the upper 8 bits before promotion
to __u64. Since tgt_data can be up to 16 bits (assertion allows up to
65535), values >= 256 would have their high byte lost.

Add explicit __u64 casts to both op and tgt_data before shifting to
ensure the shift operations happen in 64-bit space, preserving all
bits of the input values.

Fixes: 6aecda00b7d1 ("selftests: ublk: add kernel selftests for ublk")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 tools/testing/selftests/ublk/kublk.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h
index f79f93e2711e..97cf6ddbec5d 100644
--- a/tools/testing/selftests/ublk/kublk.h
+++ b/tools/testing/selftests/ublk/kublk.h
@@ -295,7 +295,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op,
 	_Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
 	ublk_assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7));
 
-	return tag | (op << 16) | (tgt_data << 24) |
+	return tag | ((__u64)op << 16) | ((__u64)tgt_data << 24) |
 		(__u64)q_id << 56 | (__u64)is_target_io << 63;
 }
 
-- 
2.47.1

Re: [PATCH] selftests: ublk: fix user_data truncation for tgt_data >= 256

[Ming Lei]

On Thu, Oct 23, 2025 at 06:51:41PM +0800, Ming Lei wrote:
> The build_user_data() function packs multiple fields into a __u64
> value using bit shifts. Without explicit __u64 casts before shifting,
> the shift operations are performed on 32-bit unsigned integers before
> being promoted to 64-bit, causing data loss.
> 
> Specifically, when tgt_data >= 256, the expression (tgt_data << 24)
> shifts on a 32-bit value, truncating the upper 8 bits before promotion
> to __u64. Since tgt_data can be up to 16 bits (assertion allows up to
> 65535), values >= 256 would have their high byte lost.
> 
> Add explicit __u64 casts to both op and tgt_data before shifting to
> ensure the shift operations happen in 64-bit space, preserving all
> bits of the input values.
> 
> Fixes: 6aecda00b7d1 ("selftests: ublk: add kernel selftests for ublk")
> Signed-off-by: Ming Lei <ming.lei@redhat.com>

Hi Jens,

Looks this patch can't be applied cleanly, please ignore it, and sorry for
the noise.

Thanks,
Ming