From 6ef108e23967a983591b3c0a21010c7b98fb884e Mon Sep 17 00:00:00 2001 From: Sungwoo Kim Date: Sun, 19 Apr 2026 22:03:28 -0400 Subject: [PATCH] Fix null-ptr-deref in bio_integrity_map_user() pin_user_pages_fast() can partially succeed and return the number of pages that were actually pinned. However, the bio_integrity_map_user() does not handle this partial pinning. This leads to a general protection fault since bvec_from_pages() dereferences an unpinned page address, which is 0. To fix this, add a check to verify that all requested memory is pinned. Reproducer in blktest: https://github.com/linux-blktests/blktests/pull/244 Kernel Oops: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6 Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers") Acked-by: Chao Shi Acked-by: Weidong Zhu Acked-by: Dave Tian Signed-off-by: Sungwoo Kim --- block/bio-integrity.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/block/bio-integrity.c b/block/bio-integrity.c index e79eaf0477943..c8cfd15fb5894 100644 --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -402,6 +402,20 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter) extraction_flags, &offset); if (unlikely(ret < 0)) goto free_bvec; + /* Handle partial pinning. This can happen when pin_user_pages_fast() + * returns fewer pages than requested + */ + if (unlikely(ret != bytes)) { + int npinned = DIV_ROUND_UP(offset + ret, PAGE_SIZE); + int i; + + for (i = 0; i < npinned; i++) + unpin_user_page(pages[i]); + if (pages != stack_pages) + kvfree(pages); + ret = -EFAULT; + goto free_bvec; + } nr_bvecs = bvec_from_pages(bvec, pages, nr_vecs, bytes, offset, &is_p2p);