A dma-buf bio stores its map in the union with bi_io_vec, which integrity checksum generation and verification walk as a bvec array. Combining the two can cause invalid memory access. Reject dma-buf registration and I/O submission on devices with integrity checksums. Fixes: 738881239a91 ("block: add dma-buf support for raw bdev") Link: https://lore.kernel.org/all/bbb87d6b-b7a3-487a-8be4-27f3f9ce4a1b@samsung.com/ Signed-off-by: Anuj Gupta --- block/blk-mq.c | 6 ++++++ block/fops.c | 2 ++ 2 files changed, 8 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index a26a11c73ee3..7fff1305b492 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -3138,6 +3138,12 @@ void blk_mq_submit_bio(struct bio *bio) goto queue_exit; } + if (unlikely(op_is_dmabuf(bio->bi_opf) && + bdev_has_integrity_csum(bio->bi_bdev))) { + bio_endio_status(bio, BLK_STS_NOTSUPP); + goto queue_exit; + } + if ((bio->bi_opf & REQ_POLLED) && !blk_mq_can_poll(q)) { bio_endio_status(bio, BLK_STS_NOTSUPP); goto queue_exit; diff --git a/block/fops.c b/block/fops.c index aeb91465c4c5..49ae0302f123 100644 --- a/block/fops.c +++ b/block/fops.c @@ -944,6 +944,8 @@ static int blkdev_init_dma_buf_io_ctx(struct file *file, return -EINVAL; if (!disk->fops->init_dma_buf_io_ctx) return -EOPNOTSUPP; + if (bdev_has_integrity_csum(bdev)) + return -EOPNOTSUPP; return disk->fops->init_dma_buf_io_ctx(bdev, ctx); } -- 2.25.1