struct ublksrv_ctrl_cmd is part of the io_uring_sqe. Since commit
87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK
issue") allowed some commands to be handled in the non-blocking issue,
the SQE may lie in userspace-mapped memory. Validate that the SQE size
is the expected 128 bytes before dereferencing it. Use READ_ONCE() to
copy the ublksrv_ctrl_cmd from the SQE to a local variable. This avoids
data races if userspace writes to the SQE concurrently.

v2:
- Make a local copy of the struct ublksrv_ctrl_cmd (Ming)
- Add Reviewed-by tag (Ming)

Caleb Sander Mateos (2):
  ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd
  ublk: drop ublk_ctrl_start_recovery() header argument

Govindarajulu Varadarajan (1):
  ublk: Validate SQE128 flag before accessing the cmd

 drivers/block/ublk_drv.c | 65 +++++++++++++++++++++-------------------
 1 file changed, 35 insertions(+), 30 deletions(-)

-- 
2.45.2

On Fri, 30 Jan 2026 10:14:11 -0700, Caleb Sander Mateos wrote:
> struct ublksrv_ctrl_cmd is part of the io_uring_sqe. Since commit
> 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK
> issue") allowed some commands to be handled in the non-blocking issue,
> the SQE may lie in userspace-mapped memory. Validate that the SQE size
> is the expected 128 bytes before dereferencing it. Use READ_ONCE() to
> copy the ublksrv_ctrl_cmd from the SQE to a local variable. This avoids
> data races if userspace writes to the SQE concurrently.
> 
> [...]

Applied, thanks!

[1/3] ublk: Validate SQE128 flag before accessing the cmd
      commit: da7e4b75e50c087d2031a92f6646eb90f7045a67
[2/3] ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd
      commit: ed9f54cc1e335096733aed03c2a46de3d58922ed
[3/3] ublk: drop ublk_ctrl_start_recovery() header argument
      commit: 373df2c0255da77f0842368708afce771e1330ca

Best regards,
-- 
Jens Axboe