[PATCH v2 3/3] ublk: remove WARN_ON_ONCE() in ublk_unmap_io()

[Caleb Sander Mateos]

io->res is set from struct ublksrv_io_cmd's result field, which is
controlled by the ublk server process, without any validation. It's thus
possible for userspace to trigger the io->res > rq_bytes warning.
ublk_copy_user_pages() already limits the copy length to the request
data length, so drop the warning.

Signed-off-by: Caleb Sander Mateos <csander@xxxxxxxxxxxxxxx>
---
 drivers/block/ublk_drv.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 2cbc359dc196..8101c2a73efd 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1495,12 +1495,10 @@ static unsigned int ublk_unmap_io(bool need_map,
 
 	if (ublk_need_unmap_req(req)) {
 		struct iov_iter iter;
 		const int dir = ITER_SOURCE;
 
-		WARN_ON_ONCE(io->res > rq_bytes);
-
 		if (import_ubuf(dir, u64_to_user_ptr(io->buf.addr), io->res,
 				&iter) < 0)
 			return 0;
 
 		return ublk_copy_user_pages(req, 0, &iter, dir);
-- 
2.54.0