From nobody Sun Feb 8 05:59:06 2026 Received: from mail-vk1-f226.google.com (mail-vk1-f226.google.com [209.85.221.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AEC4359FA1 for ; Thu, 29 Jan 2026 22:46:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.226 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726804; cv=none; b=uAGevXFQm9IR7Oes4j7QDGKlYTEFaYpYX1Ef/XsNyeH6kdK7kuGAx1zo+kI6+Yk+Bp25mKH1/lqkwQmD4OogAsv8C8JXs1d/PlymzBpddD7+u/odUR79C9lTLsEMinXPm3CLmCLj0nVINvnsfjx7DCE4UFcugqqObvLlAXwzOEE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726804; c=relaxed/simple; bh=LxRnyNMqZdQTNtI5+gBDaLbF3eE/PKtyIHlafMMwiDk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JtFhFZ3sCD8wy91+8DTnAGwo9/xYMfiKRWwxxrj1sKDaZeUvwT/L4OSRdrBDeE4T/UaQJ67dq9PDJGeIo0QzWk9oQaIVTaGBBm14XShM2okIZeLq9ThKsXV7zXq9wr/Udtnlt4Ywmiyy+3FJTXsQRMUb9iPDx96VkNDVZKB/Gcw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com; spf=fail smtp.mailfrom=purestorage.com; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b=as72ZIVJ; arc=none smtp.client-ip=209.85.221.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b="as72ZIVJ" Received: by mail-vk1-f226.google.com with SMTP id 71dfb90a1353d-56634d4247cso50684e0c.3 for ; Thu, 29 Jan 2026 14:46:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1769726802; x=1770331602; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=H6ty1uyYKM756sn4TycAtRGFmZ443M4y88c0mPRhRtU=; b=as72ZIVJaOjgNSxMUkBdNpS5Z3BXDpcbxNbG+TWiUprr4lamApg5wZQvxqP2WuMbvx 9rSl4OvvSAh/y3CouJTb6+ZmugQtJTIgSNv3BCAnqsl8zhpIEPejNc6bA/qEaskRyqzg zmKiqc4/EnXgzzDcODSIt5Xgnu0NVJxUbL/wM9tsEqkf4bOir7G65MZKC56ax7Jo4Qm8 0uHxngKDzE0MooQ9Qr+QfV1q7hRaPjwJ1vpsQyWTHfNpUsIW+vI77xvpvmbH+R04Ktvu P/qFdJ1soM093TQcaFXNUCaZdJMutqhsfR/C7LYbcgbGpiB4m2C1EpBFHLreg1QDJMDY fdpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769726802; x=1770331602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=H6ty1uyYKM756sn4TycAtRGFmZ443M4y88c0mPRhRtU=; b=c6hy3+4xEBkr0ZORQ/yu7c3nDKW5LvqfytxAbM6mKxEGwYz/Fxf2qVRcBsHPMttrMV Xr8cxI3wTqsaW626sYKScEEQOH4oYGxoO1nyYXcrqyr4Z7Fk6r6eGUZsuqrYHlgMP/6w RumLxcaotHw9cYQ86VbTKMOx0awRrMbFrz4Ve8MgTF+EkvOezA0rc4NZESxm6D2q214d 8M2ksSeu0ypE3TRl6TQqypn+cqAp4phv4djReJPJ+XRNRSvTADzh59nsck/z1AeziVC2 7AlgnZzh8PTLt+DH3qZ/3m2wxbM+e7g8Jd1tWo7C2TAlYI7lY7P+xMGB3/IWzODVBD7y Edfg== X-Forwarded-Encrypted: i=1; AJvYcCVuJmm/z54f9OFLzpVRCiJNLNHS+phM1v0lzn5awDNo/SIo4AYWCs8NSLLZ0vYsZftbT0W8YoOeBWzE0k4=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4AzyUBuIEwl90wd8gd7UNUGj7PWTutqoI6WN4oFMoXy9gEUmi B6QXT1tFF/+51jPrkZb9oM2blu8jYqzF0/5CycOf4cakY9QeUajR0Yc5Tc52nmz3gOgfhg5G1jG 55D8knhhkhmZlqFty5iv+KWSqhQf01dnAG66v X-Gm-Gg: AZuq6aLHrIsy1l8nlep/CTEwUe/wXamer09yxIzb2N1/8rq3TFnR2MbcclIxALMit7v GPWwxYNDNoi5JJFc21Haa6OsIRY33jiZ/AJAbfNu8QLDJYPLjjCCL6rwdrBV4gNfKdv0DzNL1zv k4FyHqm9SfuErvYjCm5QXnn1IRg8v1VWv9iNGm/Xq9dEFpQjhFNkmz76sQPRZBsVnO2RJoA5dVM PJUVglGQukEZCZCguizLomdtdfcKzcMLABD6xLFHvNIj9kkyCKXhUyKjxeWtyqrHRguix21cuIG mZfnN1UelrQd+Mc2k5HjIecDY/iLnbxcUaJh+gwB8gS/VXKDuEGG2isDceytjOUI1/a8gWNmeqr dgbISdFk53QJo8f3rMON20aiFrJfNlLOApBVMWGnSyg== X-Received: by 2002:a05:6122:845:b0:566:465a:8b7e with SMTP id 71dfb90a1353d-5669ffcf054mr166347e0c.1.1769726801899; Thu, 29 Jan 2026 14:46:41 -0800 (PST) Received: from c7-smtp-2023.dev.purestorage.com ([208.88.159.129]) by smtp-relay.gmail.com with ESMTPS id 71dfb90a1353d-56685afbe3csm666803e0c.1.2026.01.29.14.46.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jan 2026 14:46:41 -0800 (PST) X-Relaying-Domain: purestorage.com Received: from dev-csander.dev.purestorage.com (dev-csander.dev.purestorage.com [10.112.29.101]) by c7-smtp-2023.dev.purestorage.com (Postfix) with ESMTP id 45719341BED; Thu, 29 Jan 2026 15:46:41 -0700 (MST) Received: by dev-csander.dev.purestorage.com (Postfix, from userid 1557716354) id 3E824E40456; Thu, 29 Jan 2026 15:46:41 -0700 (MST) From: Caleb Sander Mateos To: Ming Lei , Jens Axboe Cc: Govindarajulu Varadarajan , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Caleb Sander Mateos Subject: [PATCH 1/4] ublk: Validate SQE128 flag before accessing the cmd Date: Thu, 29 Jan 2026 15:46:14 -0700 Message-ID: <20260129224618.975401-2-csander@purestorage.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260129224618.975401-1-csander@purestorage.com> References: <20260129224618.975401-1-csander@purestorage.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Govindarajulu Varadarajan ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Govindarajulu Varadarajan Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei --- drivers/block/ublk_drv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 7981decd1cee..72ee83ae303d 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -5130,14 +5130,14 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, =20 if (ublk_ctrl_uring_cmd_may_sleep(cmd_op) && issue_flags & IO_URING_F_NONBLOCK) return -EAGAIN; =20 - ublk_ctrl_cmd_dump(cmd); - if (!(issue_flags & IO_URING_F_SQE128)) - goto out; + return -EINVAL; + + ublk_ctrl_cmd_dump(cmd); =20 ret =3D ublk_check_cmd_op(cmd_op); if (ret) goto out; =20 --=20 2.45.2 From nobody Sun Feb 8 05:59:06 2026 Received: from mail-qv1-f99.google.com (mail-qv1-f99.google.com [209.85.219.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 360DD367F44 for ; Thu, 29 Jan 2026 22:46:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726806; cv=none; b=oEouK8OZoTep0wWgKcA3B5j8xUgVbyihKfHodMQyIo1o3Cu5JzH2IH0Ly36MuyyAXj3ugvt5ZJ9cl3FOSM4wDwvCRALb/nOg+OicVB9xizCRDsNNmz2n85o+Qv/iJt1t+sre5rcYECTuGyoCantMNJK1sMbgf1cQAxmI6/EVCxQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726806; c=relaxed/simple; bh=Xdmz84zqTTMUE0Z3mzNfDk4hhafk12eGoVesk+W1+ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gTG1G1erbkkUayT802wZl89d6cxpoaYYFQkog94Wx0UtDZcE8WZMwsdGBj3NFnw3tBb0x3aYTFql7pqBOwv3PuQ38ZTER9uCe29+6nb4tM5MOpQKELFDiydfh8Z4PrIjSkcMx/f7/B4hlcNEk5iQ+Y+1R0UYtf2crF2Gj4N1jkw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com; spf=fail smtp.mailfrom=purestorage.com; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b=gDf9VBGw; arc=none smtp.client-ip=209.85.219.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b="gDf9VBGw" Received: by mail-qv1-f99.google.com with SMTP id 6a1803df08f44-89001e04908so2089886d6.3 for ; Thu, 29 Jan 2026 14:46:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1769726803; x=1770331603; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=1vZbymFAgIvRelMo7twIE31eDucHLj7gu7QW6XyWJSs=; b=gDf9VBGw1+47AmjAMQ/quL68Z4g++tZivsbZq/bm5Yj6m7IgiZW0kDzUO7l+jK7ypi cyr7UQx55zKlGQ30vlIsmGmIbemsgFDuKLSGWqHGjYY8iSdd/ROTDL2FdoGTdGPumK/0 2jCYXu7vw/sVL/SMLLEzIzdymwpjPRotIxT+HOaNxsCjBSXKLhMsybsgjkKsVFKdmCyS zwhqVLoYSZGLqFffkECkJgVC4R68rvX36loO1mE5cHRo02m3rmYVH7bVChtInhTvrpFw g2idRHn3Qjlm4dhjDY80r9RvHWX7YPGo4o+ahF3iQ4Xne2NS3s5ef4ZptppLjn+F06Gm kL3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769726803; x=1770331603; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=1vZbymFAgIvRelMo7twIE31eDucHLj7gu7QW6XyWJSs=; b=GS7O9PYwMdFVXE6JrpgOQqrvzK+RnSf6Dn4EINymp5grQVLwPVSZz7bk/9SLsZ9Lxx pvu4xrKut6eJ1oFrgD+z86MkQVM+0KW2+Nt0bMjU9rnQQ6864tXYskNrkp6B5ikw2XN0 pDNV1XLChRBIoptQolSAjwEXgi2aYgp/bhknSIFuC1yby8s9IndBEup9pDjOdyCB+8UY MdQpxIKjLlhAvivKheccYg23ISgu/Lcyheas3Av1dK+15pfq7AjKFumG1ZGwLHZn8aQy JG7RCU9MBF9oPF72aN4ukLTfsaABT74/9L94+t2j/Ut5P06KAImXrwN25nYPd4F+CfPi DkfQ== X-Forwarded-Encrypted: i=1; AJvYcCW9QHXXu7MouJ7kN+E+GlMdzbRMhpganWKi2GKpqfkYlwK77HgytKM8ccB/x4PNf8/Mp/lnKRJ3wsBGpTw=@vger.kernel.org X-Gm-Message-State: AOJu0Yz2ZBBG56nrsGWA8d/8xcARey0qIWOwQc9vrHH2kjUiBj2ZWy3b MPKpHKl9DctI/dwLUaZfTzDxo0YI4Tr8lS4b7s3rfdsEoOeuGyViRG2dJz+648zK9QIFEvqF71x FsvDy6m2JVPhscK3fhXZrpqrRNr1MbZwKPBD7d8V+gKgpH9Kjsz2z X-Gm-Gg: AZuq6aKFkJGLsxAQ7lle7pSGYJRwegqC1oAA78+is/eHSi9EAn7YojdhkaRxl1EZiAa vcp8iBT0CVfMJL1piOzG2ypyVy4uaefpdSCqPKbUzstphJU6FlGsTC4hN8snZ/Ac+tMkDiwii5z YxHV4c4dLGqD7KFK+z4a7zD0luAK8spsQdWc2dTBB3biyZOInzpTQQZ+Z5jo7IvokFK/MAWuY4X H8eaZbhITQg9xP8axxM/5rNwHqzQs9LDmFCrIKRk+BlHbayC9o7NPRQD3xyjCtu/svn0CClrm+q v1EL9LOQewbYe00mhAWAoFv1zim6KeCxo0d4NchkQzGUHxwWEQ3zuG0pvp+ikWS84vY15con3o2 NFIdafJXG/3KK7GvU/QokdINHE5Y= X-Received: by 2002:a05:622a:654:b0:4f1:96c5:b592 with SMTP id d75a77b69052e-505d22f91admr11287031cf.10.1769726802985; Thu, 29 Jan 2026 14:46:42 -0800 (PST) Received: from c7-smtp-2023.dev.purestorage.com ([2620:125:9017:12:36:3:5:0]) by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-894d36c15bfsm8682096d6.9.2026.01.29.14.46.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jan 2026 14:46:42 -0800 (PST) X-Relaying-Domain: purestorage.com Received: from dev-csander.dev.purestorage.com (dev-csander.dev.purestorage.com [10.112.29.101]) by c7-smtp-2023.dev.purestorage.com (Postfix) with ESMTP id 81EF6340603; Thu, 29 Jan 2026 15:46:42 -0700 (MST) Received: by dev-csander.dev.purestorage.com (Postfix, from userid 1557716354) id 77E28E40456; Thu, 29 Jan 2026 15:46:41 -0700 (MST) From: Caleb Sander Mateos To: Ming Lei , Jens Axboe Cc: Govindarajulu Varadarajan , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Caleb Sander Mateos Subject: [PATCH 2/4] ublk: don't write to struct ublksrv_ctrl_cmd Date: Thu, 29 Jan 2026 15:46:15 -0700 Message-ID: <20260129224618.975401-3-csander@purestorage.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260129224618.975401-1-csander@purestorage.com> References: <20260129224618.975401-1-csander@purestorage.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ublk_ctrl_uring_cmd_permission() writes to struct ublksrv_ctrl_cmd's addr and len fields, which is racy because ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in userspace-mapped memory. Store the values of addr in len in local variables instead to avoid the race. Fixes: 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONB= LOCK issue") Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei --- drivers/block/ublk_drv.c | 84 ++++++++++++++++++++-------------------- 1 file changed, 43 insertions(+), 41 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 72ee83ae303d..29c6942450c2 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -4346,24 +4346,24 @@ static int ublk_ctrl_start_dev(struct ublk_device *= ub, mutex_unlock(&ub->mutex); return ret; } =20 static int ublk_ctrl_get_queue_affinity(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) + const struct ublksrv_ctrl_cmd *header, u64 addr, u16 len) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; cpumask_var_t cpumask; unsigned long queue; unsigned int retlen; unsigned int i; int ret; =20 - if (header->len * BITS_PER_BYTE < nr_cpu_ids) + if (len * BITS_PER_BYTE < nr_cpu_ids) return -EINVAL; - if (header->len & (sizeof(unsigned long)-1)) + if (len & (sizeof(unsigned long)-1)) return -EINVAL; - if (!header->addr) + if (!addr) return -EINVAL; =20 queue =3D header->data[0]; if (queue >=3D ub->dev_info.nr_hw_queues) return -EINVAL; @@ -4375,15 +4375,15 @@ static int ublk_ctrl_get_queue_affinity(struct ublk= _device *ub, if (ub->tag_set.map[HCTX_TYPE_DEFAULT].mq_map[i] =3D=3D queue) cpumask_set_cpu(i, cpumask); } =20 ret =3D -EFAULT; - retlen =3D min_t(unsigned short, header->len, cpumask_size()); + retlen =3D min_t(unsigned short, len, cpumask_size()); if (copy_to_user(argp, cpumask, retlen)) goto out_free_cpumask; - if (retlen !=3D header->len && - clear_user(argp + retlen, header->len - retlen)) + if (retlen !=3D len && + clear_user(argp + retlen, len - retlen)) goto out_free_cpumask; =20 ret =3D 0; out_free_cpumask: free_cpumask_var(cpumask); @@ -4396,18 +4396,19 @@ static inline void ublk_dump_dev_info(struct ublksr= v_ctrl_dev_info *info) info->dev_id, info->flags); pr_devel("\t nr_hw_queues %d queue_depth %d\n", info->nr_hw_queues, info->queue_depth); } =20 -static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header, + u64 addr, u16 len) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; struct ublksrv_ctrl_dev_info info; struct ublk_device *ub; int ret =3D -EINVAL; =20 - if (header->len < sizeof(info) || !header->addr) + if (len < sizeof(info) || !addr) return -EINVAL; if (header->queue_id !=3D (u16)-1) { pr_warn("%s: queue_id is wrong %x\n", __func__, header->queue_id); return -EINVAL; @@ -4682,16 +4683,15 @@ static int ublk_ctrl_try_stop_dev(struct ublk_devic= e *ub) out: ublk_put_disk(disk); return ret; } =20 -static int ublk_ctrl_get_dev_info(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_get_dev_info(struct ublk_device *ub, u64 addr, u16 le= n) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; =20 - if (header->len < sizeof(struct ublksrv_ctrl_dev_info) || !header->addr) + if (len < sizeof(struct ublksrv_ctrl_dev_info) || !addr) return -EINVAL; =20 if (copy_to_user(argp, &ub->dev_info, sizeof(ub->dev_info))) return -EFAULT; =20 @@ -4712,24 +4712,23 @@ static void ublk_ctrl_fill_params_devt(struct ublk_= device *ub) ub->params.devt.disk_minor =3D 0; } ub->params.types |=3D UBLK_PARAM_TYPE_DEVT; } =20 -static int ublk_ctrl_get_params(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_get_params(struct ublk_device *ub, u64 addr, u16 len) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; struct ublk_params_header ph; int ret; =20 - if (header->len <=3D sizeof(ph) || !header->addr) + if (len <=3D sizeof(ph) || !addr) return -EINVAL; =20 if (copy_from_user(&ph, argp, sizeof(ph))) return -EFAULT; =20 - if (ph.len > header->len || !ph.len) + if (ph.len > len || !ph.len) return -EINVAL; =20 if (ph.len > sizeof(struct ublk_params)) ph.len =3D sizeof(struct ublk_params); =20 @@ -4742,24 +4741,23 @@ static int ublk_ctrl_get_params(struct ublk_device = *ub, mutex_unlock(&ub->mutex); =20 return ret; } =20 -static int ublk_ctrl_set_params(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_set_params(struct ublk_device *ub, u64 addr, u16 len) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; struct ublk_params_header ph; int ret =3D -EFAULT; =20 - if (header->len <=3D sizeof(ph) || !header->addr) + if (len <=3D sizeof(ph) || !addr) return -EINVAL; =20 if (copy_from_user(&ph, argp, sizeof(ph))) return -EFAULT; =20 - if (ph.len > header->len || !ph.len || !ph.types) + if (ph.len > len || !ph.len || !ph.types) return -EINVAL; =20 if (ph.len > sizeof(struct ublk_params)) ph.len =3D sizeof(struct ublk_params); =20 @@ -4857,16 +4855,16 @@ static int ublk_ctrl_end_recovery(struct ublk_devic= e *ub, out_unlock: mutex_unlock(&ub->mutex); return ret; } =20 -static int ublk_ctrl_get_features(const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_get_features(u64 addr, u16 len) { - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)addr; u64 features =3D UBLK_F_ALL; =20 - if (header->len !=3D UBLK_FEATURES_LEN || !header->addr) + if (len !=3D UBLK_FEATURES_LEN || !addr) return -EINVAL; =20 if (copy_to_user(argp, &features, UBLK_FEATURES_LEN)) return -EFAULT; =20 @@ -5028,15 +5026,15 @@ static int ublk_char_dev_permission(struct ublk_dev= ice *ub, path_put(&path); return err; } =20 static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, - struct io_uring_cmd *cmd) + struct io_uring_cmd *cmd, u64 *addr, u16 *len) { - struct ublksrv_ctrl_cmd *header =3D (struct ublksrv_ctrl_cmd *)io_uring_s= qe_cmd(cmd->sqe); + const struct ublksrv_ctrl_cmd *header =3D io_uring_sqe_cmd(cmd->sqe); bool unprivileged =3D ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; - void __user *argp =3D (void __user *)(unsigned long)header->addr; + void __user *argp =3D (void __user *)*addr; char *dev_path =3D NULL; int ret =3D 0; int mask; =20 if (!unprivileged) { @@ -5059,11 +5057,11 @@ static int ublk_ctrl_uring_cmd_permission(struct ub= lk_device *ub, * header->dev_path_len records length of dev path buffer. */ if (!header->dev_path_len || header->dev_path_len > PATH_MAX) return -EINVAL; =20 - if (header->len < header->dev_path_len) + if (*len < header->dev_path_len) return -EINVAL; =20 dev_path =3D memdup_user_nul(argp, header->dev_path_len); if (IS_ERR(dev_path)) return PTR_ERR(dev_path); @@ -5093,12 +5091,12 @@ static int ublk_ctrl_uring_cmd_permission(struct ub= lk_device *ub, goto exit; } =20 ret =3D ublk_char_dev_permission(ub, dev_path, mask); if (!ret) { - header->len -=3D header->dev_path_len; - header->addr +=3D header->dev_path_len; + *len -=3D header->dev_path_len; + *addr +=3D header->dev_path_len; } pr_devel("%s: dev id %d cmd_op %x uid %d gid %d path %s ret %d\n", __func__, ub->ub_number, cmd->cmd_op, ub->dev_info.owner_uid, ub->dev_info.owner_gid, dev_path, ret); @@ -5125,36 +5123,40 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, { const struct ublksrv_ctrl_cmd *header =3D io_uring_sqe_cmd(cmd->sqe); struct ublk_device *ub =3D NULL; u32 cmd_op =3D cmd->cmd_op; int ret =3D -EINVAL; + u64 addr; + u16 len; =20 if (ublk_ctrl_uring_cmd_may_sleep(cmd_op) && issue_flags & IO_URING_F_NONBLOCK) return -EAGAIN; =20 if (!(issue_flags & IO_URING_F_SQE128)) return -EINVAL; =20 + addr =3D READ_ONCE(header->addr); + len =3D READ_ONCE(header->len); ublk_ctrl_cmd_dump(cmd); =20 ret =3D ublk_check_cmd_op(cmd_op); if (ret) goto out; =20 if (cmd_op =3D=3D UBLK_U_CMD_GET_FEATURES) { - ret =3D ublk_ctrl_get_features(header); + ret =3D ublk_ctrl_get_features(addr, len); goto out; } =20 if (_IOC_NR(cmd_op) !=3D UBLK_CMD_ADD_DEV) { ret =3D -ENODEV; ub =3D ublk_get_device_from_id(header->dev_id); if (!ub) goto out; =20 - ret =3D ublk_ctrl_uring_cmd_permission(ub, cmd); + ret =3D ublk_ctrl_uring_cmd_permission(ub, cmd, &addr, &len); if (ret) goto put_dev; } =20 switch (_IOC_NR(cmd_op)) { @@ -5165,29 +5167,29 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, ublk_ctrl_stop_dev(ub); ret =3D 0; break; case UBLK_CMD_GET_DEV_INFO: case UBLK_CMD_GET_DEV_INFO2: - ret =3D ublk_ctrl_get_dev_info(ub, header); + ret =3D ublk_ctrl_get_dev_info(ub, addr, len); break; case UBLK_CMD_ADD_DEV: - ret =3D ublk_ctrl_add_dev(header); + ret =3D ublk_ctrl_add_dev(header, addr, len); break; case UBLK_CMD_DEL_DEV: ret =3D ublk_ctrl_del_dev(&ub, true); break; case UBLK_CMD_DEL_DEV_ASYNC: ret =3D ublk_ctrl_del_dev(&ub, false); break; case UBLK_CMD_GET_QUEUE_AFFINITY: - ret =3D ublk_ctrl_get_queue_affinity(ub, header); + ret =3D ublk_ctrl_get_queue_affinity(ub, header, addr, len); break; case UBLK_CMD_GET_PARAMS: - ret =3D ublk_ctrl_get_params(ub, header); + ret =3D ublk_ctrl_get_params(ub, addr, len); break; case UBLK_CMD_SET_PARAMS: - ret =3D ublk_ctrl_set_params(ub, header); + ret =3D ublk_ctrl_set_params(ub, addr, len); break; case UBLK_CMD_START_USER_RECOVERY: ret =3D ublk_ctrl_start_recovery(ub, header); break; case UBLK_CMD_END_USER_RECOVERY: --=20 2.45.2 From nobody Sun Feb 8 05:59:06 2026 Received: from mail-dy1-f228.google.com (mail-dy1-f228.google.com [74.125.82.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1EF8366DC6 for ; Thu, 29 Jan 2026 22:46:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.228 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726805; cv=none; b=DIAdkhWpIKNJkpqFLuIrJY69PxGi2GkFq08F+mnzhRN1IvX8xG4TZnRRgI/3IpaOhz0GH49bVyM2I8yco/YBa3bmJ52n+a1hUu8xqevUa4y8jm329MA1gLdF3La9qPJDtD0+EwzOtrh3F3XzNVeEHaol+sGUoemNZrEy3GylRgM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726805; c=relaxed/simple; bh=0LMt4jRHpu2urXzaYdjfgjXEBB8zUcqCUXvSsUOvhyM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UuiqrUrJTo6LMswBC7/C93KnBKFwot5Xf4CtMTJ0A0fvqZPXafNE+VMwNGHAUXeRM76MigA1AkaDMMrucnBhoyDYyGBFprMmzIPsdCAgQHFP/JtDQYYvA0aZITcQfMKuLYTtdrKUkgC778jyuTVgVlOViKJ/QxbE7KDu1nc2C9E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com; spf=fail smtp.mailfrom=purestorage.com; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b=OUYay9cn; arc=none smtp.client-ip=74.125.82.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b="OUYay9cn" Received: by mail-dy1-f228.google.com with SMTP id 5a478bee46e88-2b7267ff06fso3109eec.2 for ; Thu, 29 Jan 2026 14:46:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1769726803; x=1770331603; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=y/oKFZQ1e5/OZgmuar7zax65YK2duH1RPNyG6auf6wk=; b=OUYay9cnrM/N0nP68l2m4c+33Vzn03ZLZBCOOe2b4z8blut17q1OmhFlbtDeqA4mx8 t2pj3WEN4hQd16d8qdCegFjeXkpLg2swZR4pBKU9zuTJ2BNzmxX9AUAfCxTicgCqZbnZ X9e36wYnhxLfd74Y8ewPCP0venWygdGUYiJe0Hkcyw2CqE9Xmqd0NlGNioGsef7slKSk a9oMje0dCuMe8acDccZPM2PPuwe15WlNBa70sd66IRJCVoaYQ6KdIQfNcWjDb+H8os/H 1vzCVrr44OtXqa+Ocyf+g5N/Bv8x0SzCpKVfm5EcdKq1J8ZGx6/3gIB7xfmHLT2qQQeG 8N6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769726803; x=1770331603; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=y/oKFZQ1e5/OZgmuar7zax65YK2duH1RPNyG6auf6wk=; b=TjJeGywMkZkr0qkMaXD68/j5tQxSkcCxe/JM91HByQ+h9jJJxAI0nr8k+xIGwBPuBz XUhvVlQHVh2GL1XvnGYwEdm8KhOu32nP0rY4M/Nvpt7M1T5FlCOeACvLd+92MtvzDput d/oqlWJ8aEGzqjhv4ddsztWMFO2VLnue150VgqTMQ1SU2V9ia2G3tgx93LfVxMBawHDU fu2vLKal5wB3vg1Pqtgc1daI6/8LV2/aVlMXvMlVOWgnu64Iw8J9dIfK6+zuTw0ffKyI Cgq63nsRvwADwey6IR9bWZ/eodaWWqVJ4lEXPGttxzc5cTYjsEx0UWKFBrifXwD59cpI NJ9g== X-Forwarded-Encrypted: i=1; AJvYcCUbEKWo9vYIKttuy/eSnR7F5WkkqBk66VLv2eCGrdX7bge95f8upWGa3wvX7nj3j/PgehFviLW2yIU2Dwc=@vger.kernel.org X-Gm-Message-State: AOJu0Yz7cn91otYPx/8BRULbVe3RWf0pS8p63kmol4f0BttJxC65f0OF ZgL2fpaEcqILeRCQvD7SZyi1rgOK2kELCkNvCZAM1WKe+cUuJFVf5xrxJcYR9AhPeds5U4pfZOV Hy0IjxaA95Q3BgOsiQCTIdIchxJ5+QBRddsQW2JfOkH+VdjWItzZy X-Gm-Gg: AZuq6aLB0NjGLXGz+KBZwjWG/trUe4CaXKuHErBj9j96LlYqaYfobgAApdYC4AsJDBv nKSBh6nRtEIr/l33gzo2pIPpuxQxhgrHko+8hdi84VL8iXB/M3949EKSNzbe8o0fbMG11NW369i Vnfw7kpLgo/yZsIbcPy3WyPzc/lc3V2HkLqyon44N3GKVsOQi0V2wruVERJ85XZUMO/XoDX6Nwq Mf3G700VRO9XEZBU5zYB0nYOEg3dXg0EUoT5eiwANvIygSxZ8xb1PNQbgjLv0rJLiODxEdIVV2L yziABeLFcSYjTmS9WvDpYdTdIEqC0g0f2OaZhKVklHpdZWYvwVAH+ljryGdzNfvM48xvR+sIx7h fkFe1czksXSFXd/jV0Es6wAGOaog= X-Received: by 2002:a05:7022:fa6:b0:11b:98e8:624e with SMTP id a92af1059eb24-125c0fe4b12mr285821c88.4.1769726802567; Thu, 29 Jan 2026 14:46:42 -0800 (PST) Received: from c7-smtp-2023.dev.purestorage.com ([2620:125:9017:12:36:3:5:0]) by smtp-relay.gmail.com with ESMTPS id a92af1059eb24-124a9dd3268sm1092804c88.6.2026.01.29.14.46.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jan 2026 14:46:42 -0800 (PST) X-Relaying-Domain: purestorage.com Received: from dev-csander.dev.purestorage.com (dev-csander.dev.purestorage.com [10.112.29.101]) by c7-smtp-2023.dev.purestorage.com (Postfix) with ESMTP id BBF1A341C9D; Thu, 29 Jan 2026 15:46:41 -0700 (MST) Received: by dev-csander.dev.purestorage.com (Postfix, from userid 1557716354) id B0C4AE40971; Thu, 29 Jan 2026 15:46:41 -0700 (MST) From: Caleb Sander Mateos To: Ming Lei , Jens Axboe Cc: Govindarajulu Varadarajan , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Caleb Sander Mateos Subject: [PATCH 3/4] ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd Date: Thu, 29 Jan 2026 15:46:16 -0700 Message-ID: <20260129224618.975401-4-csander@purestorage.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260129224618.975401-1-csander@purestorage.com> References: <20260129224618.975401-1-csander@purestorage.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in userspace-mapped memory. It's racy to access its fields with normal loads, as userspace may write to them concurrently. Use READ_ONCE() for all the ublksrv_ctrl_cmd field accesses to avoid the race. Fixes: 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONB= LOCK issue") Signed-off-by: Caleb Sander Mateos --- drivers/block/ublk_drv.c | 77 +++++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 40 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 29c6942450c2..49510216832f 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -4188,15 +4188,13 @@ static struct ublk_device *ublk_get_device_from_id(= int idx) spin_unlock(&ublk_idr_lock); =20 return ub; } =20 -static int ublk_ctrl_start_dev(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_start_dev(struct ublk_device *ub, int ublksrv_pid) { const struct ublk_param_basic *p =3D &ub->params.basic; - int ublksrv_pid =3D (int)header->data[0]; struct queue_limits lim =3D { .logical_block_size =3D 1 << p->logical_bs_shift, .physical_block_size =3D 1 << p->physical_bs_shift, .io_min =3D 1 << p->io_min_shift, .io_opt =3D 1 << p->io_opt_shift, @@ -4346,15 +4344,14 @@ static int ublk_ctrl_start_dev(struct ublk_device *= ub, mutex_unlock(&ub->mutex); return ret; } =20 static int ublk_ctrl_get_queue_affinity(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header, u64 addr, u16 len) + u64 queue, u64 addr, u16 len) { void __user *argp =3D (void __user *)addr; cpumask_var_t cpumask; - unsigned long queue; unsigned int retlen; unsigned int i; int ret; =20 if (len * BITS_PER_BYTE < nr_cpu_ids) @@ -4362,11 +4359,10 @@ static int ublk_ctrl_get_queue_affinity(struct ublk= _device *ub, if (len & (sizeof(unsigned long)-1)) return -EINVAL; if (!addr) return -EINVAL; =20 - queue =3D header->data[0]; if (queue >=3D ub->dev_info.nr_hw_queues) return -EINVAL; =20 if (!zalloc_cpumask_var(&cpumask, GFP_KERNEL)) return -ENOMEM; @@ -4396,23 +4392,22 @@ static inline void ublk_dump_dev_info(struct ublksr= v_ctrl_dev_info *info) info->dev_id, info->flags); pr_devel("\t nr_hw_queues %d queue_depth %d\n", info->nr_hw_queues, info->queue_depth); } =20 -static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header, - u64 addr, u16 len) +static int ublk_ctrl_add_dev(u32 dev_id, u16 qid, u64 addr, u16 len) { void __user *argp =3D (void __user *)addr; struct ublksrv_ctrl_dev_info info; struct ublk_device *ub; int ret =3D -EINVAL; =20 if (len < sizeof(info) || !addr) return -EINVAL; - if (header->queue_id !=3D (u16)-1) { + if (qid !=3D (u16)-1) { pr_warn("%s: queue_id is wrong %x\n", - __func__, header->queue_id); + __func__, qid); return -EINVAL; } =20 if (copy_from_user(&info, argp, sizeof(info))) return -EFAULT; @@ -4473,17 +4468,17 @@ static int ublk_ctrl_add_dev(const struct ublksrv_c= trl_cmd *header, return -EINVAL; =20 /* the created device is always owned by current user */ ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid); =20 - if (header->dev_id !=3D info.dev_id) { + if (dev_id !=3D info.dev_id) { pr_warn("%s: dev id not match %u %u\n", - __func__, header->dev_id, info.dev_id); + __func__, dev_id, info.dev_id); return -EINVAL; } =20 - if (header->dev_id !=3D U32_MAX && header->dev_id >=3D UBLK_MAX_UBLKS) { + if (dev_id !=3D U32_MAX && dev_id >=3D UBLK_MAX_UBLKS) { pr_warn("%s: dev id is too large. Max supported is %d\n", __func__, UBLK_MAX_UBLKS - 1); return -EINVAL; } =20 @@ -4505,11 +4500,11 @@ static int ublk_ctrl_add_dev(const struct ublksrv_c= trl_cmd *header, mutex_init(&ub->mutex); spin_lock_init(&ub->lock); mutex_init(&ub->cancel_mutex); INIT_WORK(&ub->partition_scan_work, ublk_partition_scan_work); =20 - ret =3D ublk_alloc_dev_number(ub, header->dev_id); + ret =3D ublk_alloc_dev_number(ub, dev_id); if (ret < 0) goto out_free_ub; =20 memcpy(&ub->dev_info, &info, sizeof(info)); =20 @@ -4641,17 +4636,15 @@ static int ublk_ctrl_del_dev(struct ublk_device **p= _ub, bool wait) if (wait && wait_event_interruptible(ublk_idr_wq, ublk_idr_freed(idx))) return -EINTR; return 0; } =20 -static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd) +static inline void ublk_ctrl_cmd_dump(u32 cmd_op, u32 dev_id, u16 qid, + u64 data, u64 addr, u16 len) { - const struct ublksrv_ctrl_cmd *header =3D io_uring_sqe_cmd(cmd->sqe); - pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n", - __func__, cmd->cmd_op, header->dev_id, header->queue_id, - header->data[0], header->addr, header->len); + __func__, cmd_op, dev_id, qid, data, addr, len); } =20 static void ublk_ctrl_stop_dev(struct ublk_device *ub) { ublk_stop_dev(ub); @@ -4819,13 +4812,12 @@ static int ublk_ctrl_start_recovery(struct ublk_dev= ice *ub, mutex_unlock(&ub->mutex); return ret; } =20 static int ublk_ctrl_end_recovery(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) + const struct ublksrv_ctrl_cmd *header, int ublksrv_pid) { - int ublksrv_pid =3D (int)header->data[0]; int ret =3D -EINVAL; =20 pr_devel("%s: Waiting for all FETCH_REQs, dev id %d...\n", __func__, header->dev_id); =20 @@ -4869,14 +4861,13 @@ static int ublk_ctrl_get_features(u64 addr, u16 len) return -EFAULT; =20 return 0; } =20 -static void ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksr= v_ctrl_cmd *header) +static void ublk_ctrl_set_size(struct ublk_device *ub, u64 new_size) { struct ublk_param_basic *p =3D &ub->params.basic; - u64 new_size =3D header->data[0]; =20 mutex_lock(&ub->mutex); p->dev_sectors =3D new_size; set_capacity_and_notify(ub->ub_disk, p->dev_sectors); mutex_unlock(&ub->mutex); @@ -4950,15 +4941,13 @@ static int ublk_wait_for_idle_io(struct ublk_device= *ub, ret =3D 0; =20 return ret; } =20 -static int ublk_ctrl_quiesce_dev(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_quiesce_dev(struct ublk_device *ub, u64 timeout_ms) { /* zero means wait forever */ - u64 timeout_ms =3D header->data[0]; struct gendisk *disk; int ret =3D -ENODEV; =20 if (!(ub->dev_info.flags & UBLK_F_QUIESCE)) return -EOPNOTSUPP; @@ -5032,10 +5021,11 @@ static int ublk_ctrl_uring_cmd_permission(struct ub= lk_device *ub, { const struct ublksrv_ctrl_cmd *header =3D io_uring_sqe_cmd(cmd->sqe); bool unprivileged =3D ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; void __user *argp =3D (void __user *)*addr; char *dev_path =3D NULL; + u16 dev_path_len; int ret =3D 0; int mask; =20 if (!unprivileged) { if (!capable(CAP_SYS_ADMIN)) @@ -5054,17 +5044,18 @@ static int ublk_ctrl_uring_cmd_permission(struct ub= lk_device *ub, * User has to provide the char device path for unprivileged ublk * * header->addr always points to the dev path buffer, and * header->dev_path_len records length of dev path buffer. */ - if (!header->dev_path_len || header->dev_path_len > PATH_MAX) + dev_path_len =3D READ_ONCE(header->dev_path_len); + if (!dev_path_len || dev_path_len > PATH_MAX) return -EINVAL; =20 - if (*len < header->dev_path_len) + if (*len < dev_path_len) return -EINVAL; =20 - dev_path =3D memdup_user_nul(argp, header->dev_path_len); + dev_path =3D memdup_user_nul(argp, dev_path_len); if (IS_ERR(dev_path)) return PTR_ERR(dev_path); =20 ret =3D -EINVAL; switch (_IOC_NR(cmd->cmd_op)) { @@ -5091,12 +5082,12 @@ static int ublk_ctrl_uring_cmd_permission(struct ub= lk_device *ub, goto exit; } =20 ret =3D ublk_char_dev_permission(ub, dev_path, mask); if (!ret) { - *len -=3D header->dev_path_len; - *addr +=3D header->dev_path_len; + *len -=3D dev_path_len; + *addr +=3D dev_path_len; } pr_devel("%s: dev id %d cmd_op %x uid %d gid %d path %s ret %d\n", __func__, ub->ub_number, cmd->cmd_op, ub->dev_info.owner_uid, ub->dev_info.owner_gid, dev_path, ret); @@ -5123,23 +5114,29 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, { const struct ublksrv_ctrl_cmd *header =3D io_uring_sqe_cmd(cmd->sqe); struct ublk_device *ub =3D NULL; u32 cmd_op =3D cmd->cmd_op; int ret =3D -EINVAL; + u32 dev_id; + u16 qid; + u64 data; u64 addr; u16 len; =20 if (ublk_ctrl_uring_cmd_may_sleep(cmd_op) && issue_flags & IO_URING_F_NONBLOCK) return -EAGAIN; =20 if (!(issue_flags & IO_URING_F_SQE128)) return -EINVAL; =20 + dev_id =3D READ_ONCE(header->dev_id); + qid =3D READ_ONCE(header->queue_id); + data =3D READ_ONCE(header->data[0]); addr =3D READ_ONCE(header->addr); len =3D READ_ONCE(header->len); - ublk_ctrl_cmd_dump(cmd); + ublk_ctrl_cmd_dump(cmd_op, dev_id, qid, data, addr, len); =20 ret =3D ublk_check_cmd_op(cmd_op); if (ret) goto out; =20 @@ -5148,42 +5145,42 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, goto out; } =20 if (_IOC_NR(cmd_op) !=3D UBLK_CMD_ADD_DEV) { ret =3D -ENODEV; - ub =3D ublk_get_device_from_id(header->dev_id); + ub =3D ublk_get_device_from_id(dev_id); if (!ub) goto out; =20 ret =3D ublk_ctrl_uring_cmd_permission(ub, cmd, &addr, &len); if (ret) goto put_dev; } =20 switch (_IOC_NR(cmd_op)) { case UBLK_CMD_START_DEV: - ret =3D ublk_ctrl_start_dev(ub, header); + ret =3D ublk_ctrl_start_dev(ub, data); break; case UBLK_CMD_STOP_DEV: ublk_ctrl_stop_dev(ub); ret =3D 0; break; case UBLK_CMD_GET_DEV_INFO: case UBLK_CMD_GET_DEV_INFO2: ret =3D ublk_ctrl_get_dev_info(ub, addr, len); break; case UBLK_CMD_ADD_DEV: - ret =3D ublk_ctrl_add_dev(header, addr, len); + ret =3D ublk_ctrl_add_dev(dev_id, qid, addr, len); break; case UBLK_CMD_DEL_DEV: ret =3D ublk_ctrl_del_dev(&ub, true); break; case UBLK_CMD_DEL_DEV_ASYNC: ret =3D ublk_ctrl_del_dev(&ub, false); break; case UBLK_CMD_GET_QUEUE_AFFINITY: - ret =3D ublk_ctrl_get_queue_affinity(ub, header, addr, len); + ret =3D ublk_ctrl_get_queue_affinity(ub, data, addr, len); break; case UBLK_CMD_GET_PARAMS: ret =3D ublk_ctrl_get_params(ub, addr, len); break; case UBLK_CMD_SET_PARAMS: @@ -5191,18 +5188,18 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, break; case UBLK_CMD_START_USER_RECOVERY: ret =3D ublk_ctrl_start_recovery(ub, header); break; case UBLK_CMD_END_USER_RECOVERY: - ret =3D ublk_ctrl_end_recovery(ub, header); + ret =3D ublk_ctrl_end_recovery(ub, header, data); break; case UBLK_CMD_UPDATE_SIZE: - ublk_ctrl_set_size(ub, header); + ublk_ctrl_set_size(ub, data); ret =3D 0; break; case UBLK_CMD_QUIESCE_DEV: - ret =3D ublk_ctrl_quiesce_dev(ub, header); + ret =3D ublk_ctrl_quiesce_dev(ub, data); break; case UBLK_CMD_TRY_STOP_DEV: ret =3D ublk_ctrl_try_stop_dev(ub); break; default: @@ -5213,11 +5210,11 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, put_dev: if (ub) ublk_put_device(ub); out: pr_devel("%s: cmd done ret %d cmd_op %x, dev id %d qid %d\n", - __func__, ret, cmd->cmd_op, header->dev_id, header->queue_id); + __func__, ret, cmd_op, dev_id, qid); return ret; } =20 static const struct file_operations ublk_ctl_fops =3D { .open =3D nonseekable_open, --=20 2.45.2 From nobody Sun Feb 8 05:59:06 2026 Received: from mail-yw1-f228.google.com (mail-yw1-f228.google.com [209.85.128.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DD9B363C67 for ; Thu, 29 Jan 2026 22:46:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.228 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726804; cv=none; b=HTXLIrYgzwtcYOPtvidBbtTkypl6Q5sbtfrBZtk4eGCYXQFkiPDxvszkNTmoSohjoT06W2/uGOEVNf/AeV9equziVxLE7b73Px2ZwG5X8EKv2CKHjta3Ndlr56eh0m8pqaLFrmO1EYkAzMFQ3H3n0AM4AodA524fzgb5612TkVQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769726804; c=relaxed/simple; bh=JuyPoYE7z3HLBgfeByBLU9Py+kqJmtHIeOM/fvYhpqQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=odL7uPiF3hkW5zYuc8P7AQrSNO7vhhelkC3pvE7eDOoi44qCafBfcQwqbB+ZxKgZAfKaFsN/bWEDP9g7fMLlNefU+JwXuUQBSmh2n0wModDLDMnMS8J8irz0deVNueUq1q8ytlHeTMjAGRh6heFR+hA318tbfyB5L6L8GFB92NA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com; spf=fail smtp.mailfrom=purestorage.com; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b=FY8q18pg; arc=none smtp.client-ip=209.85.128.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b="FY8q18pg" Received: by mail-yw1-f228.google.com with SMTP id 00721157ae682-78f9be198aaso457b3.3 for ; Thu, 29 Jan 2026 14:46:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1769726802; x=1770331602; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=fgzM/bjzSQsfBN2N2MIl2I8sr30VY03/XQyJxra3YSU=; b=FY8q18pgBejzl90XrrNPkORBu2HUWCdGdjIbG/RouTEXJKxhm8RDrL2IB5ImiqFCug ZcZtOiigSFES8PWCPfOOCImoXsIw76MPI01DfUp9IqJ3X0lyhiBrPUrDl06kQbd5t2ZS 87xhOKIzCL/lt6gf8ujxSS8jnM8e/G4I5Ta/8lgRI73PtiEzhs3RXqpbzro0UKRB3klR RhDRhCoT2kuHaaJzf0yptAo5v3ExwEBZ6Pk30m535nMI7iGo8vMg/vdChIyA/g2ENLPl NF3i4+JVF5ZZ+UrDqbZzm4clmv+MOuW+fX1BtpqijOGcWL1chHVkqB+On8jsCa1UU6aG 0Z2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769726802; x=1770331602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=fgzM/bjzSQsfBN2N2MIl2I8sr30VY03/XQyJxra3YSU=; b=vRbUvQIvpdzZvbMwvXTE6FWV33UvC6RY/1S8Mf2fAMVVk0ux5vo/HsiDySdonbd4sx lTuz+Nka7SXqF36E1yLc8s/M4WIgNjidGdbdjLfdaQbzTTMDYqOjufMEGretMJmHs+mO DJVPWsVO0Ib+O0nnmfKsZlyxpW5m8XNgll0dM4Jj7GJyOGxg0wIAeuBE4hR2ST8sgf6Z KVJqic3E7IdNpF+nXZMq0FHVi8XDuTzB0yk8gasTFZlO5HXpnjrkeMcEZSbCisoZTHHR 412OWlvTco6tU9RM+Nn6Hg2wyu+1/gq2T70NDIDfxyje7POnMFXhQGj+2+clUYQ0AQNx rrRw== X-Forwarded-Encrypted: i=1; AJvYcCWB8fTrvRitCerB346nIldVNkJXeIHKHV1V9swvH3gaP/JJkSAuiqW45qFH3mZdgNITvO4CHjru2r+CIh8=@vger.kernel.org X-Gm-Message-State: AOJu0YzN8ebJipugr2A/uM9f2bc/fwNu3ZhV3HuvFVEV47X7C46CpuhA /vwXIDDPYh1ejFx2Q88oGnkPRqAV6nqzEZtQQgpzwWRkjS750laptsbIEAXPUW6rhzoglp6C4Mt i6tVPHvCiEBhJfzOESxViM+ac8B1bWJXSCVnl X-Gm-Gg: AZuq6aLDGx+VoPO4GwwKRfklGLS8SLryXshyZsQSdAgCLu5okWqt+agVu1GO7dSMKPX oWzGMvObSFly2BWP6yIOqcaLskfvNXK2xcYgVEtOFahLo8znrjF74hsAdCi65Ow5qK0bHQch9D9 Fab0v+MrNmTtdxaWqrs8GhCDiQjVRRL0oJ8loFKVS9UNzBi1ucJcBVBEaVmADMtWaE5QgQF1iMF Oyg9YTYgEMoCplD6gne47GyLnCLyPIAd/b2XagHJysb1u0toCD0CeKF3lMsnhHbs4AJoyHore8i 0+Ffg8eyYi+n3dkL+WAX8X/VPPLMNz7BKFr6jfzYHbRZWJKh19yefGqHf0LDuHbzsDwAtefDdCR H3ZUywZBaNNBVyJekmgQFdKZRnScIlqMpMCP2ClGpBQ== X-Received: by 2002:a05:690c:38b:b0:78f:c943:b2f3 with SMTP id 00721157ae682-7949e0082bfmr9678737b3.4.1769726802516; Thu, 29 Jan 2026 14:46:42 -0800 (PST) Received: from c7-smtp-2023.dev.purestorage.com ([208.88.159.129]) by smtp-relay.gmail.com with ESMTPS id 00721157ae682-7948277e1aasm3617767b3.5.2026.01.29.14.46.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jan 2026 14:46:42 -0800 (PST) X-Relaying-Domain: purestorage.com Received: from dev-csander.dev.purestorage.com (dev-csander.dev.purestorage.com [10.112.29.101]) by c7-smtp-2023.dev.purestorage.com (Postfix) with ESMTP id EEB37341D32; Thu, 29 Jan 2026 15:46:41 -0700 (MST) Received: by dev-csander.dev.purestorage.com (Postfix, from userid 1557716354) id E5603E40971; Thu, 29 Jan 2026 15:46:41 -0700 (MST) From: Caleb Sander Mateos To: Ming Lei , Jens Axboe Cc: Govindarajulu Varadarajan , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Caleb Sander Mateos Subject: [PATCH 4/4] ublk: drop ublk_ctrl_{start,end}_recovery() header argument Date: Thu, 29 Jan 2026 15:46:17 -0700 Message-ID: <20260129224618.975401-5-csander@purestorage.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260129224618.975401-1-csander@purestorage.com> References: <20260129224618.975401-1-csander@purestorage.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ublk_ctrl_start_recovery() and ublk_ctrl_end_recovery() only use their const struct ublksrv_ctrl_cmd *header arguments to log the dev_id. But this value is already available in struct ublk_device's ub_number field. So log ub_number instead and drop the unused header arguments. Signed-off-by: Caleb Sander Mateos --- drivers/block/ublk_drv.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 49510216832f..a0d1285d24d1 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -4773,12 +4773,11 @@ static int ublk_ctrl_set_params(struct ublk_device = *ub, u64 addr, u16 len) mutex_unlock(&ub->mutex); =20 return ret; } =20 -static int ublk_ctrl_start_recovery(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header) +static int ublk_ctrl_start_recovery(struct ublk_device *ub) { int ret =3D -EINVAL; =20 mutex_lock(&ub->mutex); if (ublk_nosrv_should_stop_dev(ub)) @@ -4803,31 +4802,30 @@ static int ublk_ctrl_start_recovery(struct ublk_dev= ice *ub, */ if (test_bit(UB_STATE_OPEN, &ub->state) || !ublk_dev_in_recoverable_state= (ub)) { ret =3D -EBUSY; goto out_unlock; } - pr_devel("%s: start recovery for dev id %d.\n", __func__, header->dev_id); + pr_devel("%s: start recovery for dev id %d\n", __func__, ub->ub_number); init_completion(&ub->completion); ret =3D 0; out_unlock: mutex_unlock(&ub->mutex); return ret; } =20 -static int ublk_ctrl_end_recovery(struct ublk_device *ub, - const struct ublksrv_ctrl_cmd *header, int ublksrv_pid) +static int ublk_ctrl_end_recovery(struct ublk_device *ub, int ublksrv_pid) { int ret =3D -EINVAL; =20 pr_devel("%s: Waiting for all FETCH_REQs, dev id %d...\n", __func__, - header->dev_id); + ub->ub_number); =20 if (wait_for_completion_interruptible(&ub->completion)) return -EINTR; =20 pr_devel("%s: All FETCH_REQs received, dev id %d\n", __func__, - header->dev_id); + ub->ub_number); =20 if (ub->ublksrv_tgid !=3D ublksrv_pid) return -EINVAL; =20 mutex_lock(&ub->mutex); @@ -4839,11 +4837,11 @@ static int ublk_ctrl_end_recovery(struct ublk_devic= e *ub, goto out_unlock; } ub->dev_info.ublksrv_pid =3D ublksrv_pid; ub->dev_info.state =3D UBLK_S_DEV_LIVE; pr_devel("%s: new ublksrv_pid %d, dev id %d\n", - __func__, ublksrv_pid, header->dev_id); + __func__, ublksrv_pid, ub->ub_number); blk_mq_kick_requeue_list(ub->ub_disk->queue); ret =3D 0; out_unlock: mutex_unlock(&ub->mutex); return ret; @@ -5185,14 +5183,14 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd = *cmd, break; case UBLK_CMD_SET_PARAMS: ret =3D ublk_ctrl_set_params(ub, addr, len); break; case UBLK_CMD_START_USER_RECOVERY: - ret =3D ublk_ctrl_start_recovery(ub, header); + ret =3D ublk_ctrl_start_recovery(ub); break; case UBLK_CMD_END_USER_RECOVERY: - ret =3D ublk_ctrl_end_recovery(ub, header, data); + ret =3D ublk_ctrl_end_recovery(ub, data); break; case UBLK_CMD_UPDATE_SIZE: ublk_ctrl_set_size(ub, data); ret =3D 0; break; --=20 2.45.2