From: Zizhi Wo Commit 697ba0b6ec4a ("block: fix integer overflow in BLKSECDISCARD") fixed the start+len overflow via check_add_overflow() but did not handle the start=0, len=0 case. There, start + len = 0, so end = 0 passes all checks, and truncate_bdev_range()->truncate_inode_pages_range() is then called with lend=UINT64_MAX, whitch is the "truncate to the end of file" sentinel, so the entire page cache is invalidated. Fix this by replacing the validation with blk_validate_byte_range(), which already rejects a zero-length range and is what BLKDISCARD uses. This also switches the alignment check from a hardcoded 512 to bdev_logical_block_size(). Fixes: 0bd1ed4860d0 ("block: pass inclusive 'lend' parameter to truncate_inode_pages_range") Signed-off-by: Zizhi Wo Reviewed-by: Yu Kuai Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche --- v2: Add the fixtag. v1: https://lore.kernel.org/all/20260704073942.3760597-1-wozizhi@huaweicloud.com/ --- block/ioctl.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 64b4e6c0f696..53558963d9d7 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -175,12 +175,11 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, } static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, void __user *argp) { - uint64_t start, len, end; - uint64_t range[2]; + uint64_t range[2], start, len; int err; if (!(mode & BLK_OPEN_WRITE)) return -EBADF; if (!bdev_max_secure_erase_sectors(bdev)) @@ -188,19 +187,17 @@ static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, if (copy_from_user(range, argp, sizeof(range))) return -EFAULT; start = range[0]; len = range[1]; - if ((start & 511) || (len & 511)) - return -EINVAL; - if (check_add_overflow(start, len, &end) || - end > bdev_nr_bytes(bdev)) - return -EINVAL; + err = blk_validate_byte_range(bdev, start, len); + if (err) + return err; inode_lock(bdev->bd_mapping->host); filemap_invalidate_lock(bdev->bd_mapping); - err = truncate_bdev_range(bdev, mode, start, end - 1); + err = truncate_bdev_range(bdev, mode, start, start + len - 1); if (!err) err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9, GFP_KERNEL); filemap_invalidate_unlock(bdev->bd_mapping); inode_unlock(bdev->bd_mapping->host); -- 2.52.0