Re: [PATCH v4] block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

Re: [PATCH v4] block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

[Sungwoo Kim]

Hello,

Just a gentle reminder on this patch in case it got missed.
Please let me know if there are any concerns or changes needed.

Thanks,
Sungwoo.

On Thu, Apr 30, 2026 at 9:35 AM Shin'ichiro Kawasaki
<shinichiro.kawasaki@wdc.com> wrote:
>
> On Apr 27, 2026 / 00:09, Sungwoo Kim wrote:
> > pin_user_pages_fast() can partially succeed and return the number of
> > pages that were actually pinned. However, the bio_integrity_map_user()
> > does not handle this partial pinning. This leads to a general protection
> > fault since bvec_from_pages() dereferences an unpinned page address,
> > which is 0.
> >
> > To fix this, add a check to verify that all requested memory is pinned.
> > If partial pinning occurs, unpin the memory and return -EFAULT.
> >
> > Reproducer in blktest: https://github.com/linux-blktests/blktests/pull/244
>
> The blktests Pull Request modifies the test case nvme/064 to write with 80KiB
> size metadata. With this change, I confirmed that the Oops below was recreated
> on my test system using the kernel v7.1-rc1.
>
> >
> > Kernel Oops:
> >
> > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy)
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
> > RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6
> >
> > Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers")
> > Acked-by: Chao Shi <cshi008@fiu.edu>
> > Acked-by: Weidong Zhu <weizhu@fiu.edu>
> > Acked-by: Dave Tian <daveti@purdue.edu>
> > Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
> > ---
> > V3: https://lore.kernel.org/linux-block/20260420020327.1667156-3-iam@sung-woo.kim/
> >
> > V3->V4
> > - Addressed a sashiko's comments [1], if it makes sense.
> > - V3 wrongly assumed that iov_iter_extract_pages() always pins user
> >   memory.
> > - V3 insufficiently handled the return value range.
> >
> > [1] https://sashiko.dev/#/patchset/20260420020327.1667156-3-iam%40sung-woo.kim
>
> I applied this v4 patch to v7.1-rc1 kernel. With this, I confirmed that the
> Oops goes away. Looks good from testing point of view.
>
> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
>

Re: [PATCH v4] block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

[Jens Axboe]

> diff --git a/block/bio-integrity.c b/block/bio-integrity.c
> index e54c6e06e1cb..766cc2d1d51c 100644
> --- a/block/bio-integrity.c
> +++ b/block/bio-integrity.c
> @@ -403,6 +403,23 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
>  	if (unlikely(ret < 0))
>  		goto free_bvec;
>  
> +	/* Handle partial pinning. This can happen when pin_user_pages_fast()
> +	 * returns fewer pages than requested
> +	 */

Please follow the multi-line comment style used in the code around you.

> +	if (user_backed_iter(iter) && unlikely(ret != bytes)) {
> +		if (0 < ret) {

And never do this, it's so much worse to read than if (ret > 0)

-- 
Jens Axboe