From 15c1339ef44054cc79c49b40b24a26aa80a2253e Mon Sep 17 00:00:00 2001 From: Caleb Sander Mateos Date: Wed, 29 Jul 2026 11:10:41 -0600 Subject: [PATCH] ublk: remove WARN_ON_ONCE() in ublk_unmap_io() io->res is set from struct ublksrv_io_cmd's result field, which is controlled by the ublk server process, without any validation. It's thus possible for userspace to trigger the io->res > rq_bytes warning. ublk_copy_user_pages() already limits the copy length to the request data length, so drop the warning. Signed-off-by: Caleb Sander Mateos Link: https://patch.msgid.link/20260729171041.45061-4-csander@purestorage.com Signed-off-by: Jens Axboe --- drivers/block/ublk_drv.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 2cbc359dc196..8101c2a73efd 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -1497,8 +1497,6 @@ static unsigned int ublk_unmap_io(bool need_map, struct iov_iter iter; const int dir = ITER_SOURCE; - WARN_ON_ONCE(io->res > rq_bytes); - if (import_ubuf(dir, u64_to_user_ptr(io->buf.addr), io->res, &iter) < 0) return 0;