Commit 6240f43b authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

ublk: enhance check for register/unregister io buffer command 



The simple check of UBLK_IO_FLAG_OWNED_BY_SRV can avoid incorrect
register/unregister io buffer easily, so check it before calling
starting to register/un-register io buffer.

Also only allow io buffer register/unregister uring_cmd in case of
UBLK_F_SUPPORT_ZERO_COPY.

Also mark argument 'ublk_queue *' of ublk_register_io_buf as const.

Reviewed-by: default avatarCaleb Sander Mateos <csander@purestorage.com>
Fixes: 1f6540e2 ("ublk: zc register/unregister bvec")
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250429022941.1718671-4-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 69edf98b

drivers/block/ublk_drv.c

+20 −4
Original line number Diff line number Diff line
@@ -201,7 +201,7 @@ struct ublk_params_header { 
static void ublk_stop_dev_unlocked(struct ublk_device *ub);

static void ublk_abort_queue(struct ublk_device *ub, struct ublk_queue *ubq);

static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,

		struct ublk_queue *ubq, int tag, size_t offset);

		const struct ublk_queue *ubq, int tag, size_t offset);

static inline unsigned int ublk_req_build_flags(struct request *req);

static inline struct ublksrv_io_desc *ublk_get_iod(struct ublk_queue *ubq,

						   int tag);
@@ -1949,13 +1949,20 @@ static void ublk_io_release(void *priv) 
}



static int ublk_register_io_buf(struct io_uring_cmd *cmd,

				struct ublk_queue *ubq, unsigned int tag,

				const struct ublk_queue *ubq, unsigned int tag,

				unsigned int index, unsigned int issue_flags)

{

	struct ublk_device *ub = cmd->file->private_data;

	const struct ublk_io *io = &ubq->ios[tag];

	struct request *req;

	int ret;



	if (!ublk_support_zero_copy(ubq))

		return -EINVAL;



	if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))

		return -EINVAL;



	req = __ublk_check_and_get_req(ub, ubq, tag, 0);

	if (!req)

		return -EINVAL;
@@ -1971,8 +1978,17 @@ static int ublk_register_io_buf(struct io_uring_cmd *cmd, 
}



static int ublk_unregister_io_buf(struct io_uring_cmd *cmd,

				  const struct ublk_queue *ubq, unsigned int tag,

				  unsigned int index, unsigned int issue_flags)

{

	const struct ublk_io *io = &ubq->ios[tag];



	if (!ublk_support_zero_copy(ubq))

		return -EINVAL;



	if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))

		return -EINVAL;



	return io_buffer_unregister_bvec(cmd, index, issue_flags);

}
@@ -2076,7 +2092,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd, 
	case UBLK_IO_REGISTER_IO_BUF:

		return ublk_register_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);

	case UBLK_IO_UNREGISTER_IO_BUF:

		return ublk_unregister_io_buf(cmd, ub_cmd->addr, issue_flags);

		return ublk_unregister_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);

	case UBLK_IO_FETCH_REQ:

		ret = ublk_fetch(cmd, ubq, io, ub_cmd->addr);

		if (ret)
@@ -2128,7 +2144,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd, 
}



static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,

		struct ublk_queue *ubq, int tag, size_t offset)

		const struct ublk_queue *ubq, int tag, size_t offset)

{

	struct request *req;