[PATCH 1/2] block: reject dma-bufs larger than 4GiB

[Keith Busch]

From: Keith Busch <kbusch at kernel.org>

The dma-buf offset is set in the 32-bit bvec_iter bi_offset. Reject
buffers that can carry an offset that would wrap.

Fixes: 839231d19393 ("block: add dma-buf support for raw bdev")
Signed-off-by: Keith Busch <kbusch at kernel.org>
---
 block/fops.c | 3 ++++
 1 file changed, 3 insertions(+)

diff --git a/block/fops.c b/block/fops.c
index 46cb86dd36d23..a974b423869eb 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -19,6 +19,7 @@
 #include <linux/iomap.h>
 #include <linux/module.h>
 #include <linux/io_uring/cmd.h>
+#include <linux/dma-buf-io.h>
 #include "blk.h"
 
 static inline struct inode *bdev_file_inode(struct file *file)
@@ -1009,6 +1010,9 @@ static int blkdev_init_dma_buf_io_ctx(struct file *file,
 
 	if (!(file->f_flags & O_DIRECT))
 		return -EINVAL;
+	if (ctx->dmabuf->size > UINT_MAX)
+		return -EINVAL;
 	if (!disk->fops->init_dma_buf_io_ctx)
 		return -EOPNOTSUPP;
 	if (bdev_has_integrity_csum(bdev))
-- 
2.52.0