tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd

struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in
userspace-mapped memory. It's racy to access its fields with normal
loads, as userspace may write to them concurrently. Use READ_ONCE() to
copy the ublksrv_ctrl_cmd from the io_uring_sqe to the stack. Use the
local copy in place of the one in the io_uring_sqe.

Fixes: 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK issue")
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Caleb Sander Mateos and committed by
Jens Axboe ed9f54cc da7e4b75

+31 -25
+31 -25
drivers/block/ublk_drv.c
··· 4731 4731 return 0; 4732 4732 } 4733 4733 4734 - static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd) 4734 + static inline void ublk_ctrl_cmd_dump(u32 cmd_op, 4735 + const struct ublksrv_ctrl_cmd *header) 4735 4736 { 4736 - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); 4737 - 4738 4737 pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n", 4739 - __func__, cmd->cmd_op, header->dev_id, header->queue_id, 4738 + __func__, cmd_op, header->dev_id, header->queue_id, 4740 4739 header->data[0], header->addr, header->len); 4741 4740 } 4742 4741 ··· 5118 5119 } 5119 5120 5120 5121 static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, 5121 - struct io_uring_cmd *cmd) 5122 + u32 cmd_op, struct ublksrv_ctrl_cmd *header) 5122 5123 { 5123 - struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)io_uring_sqe_cmd(cmd->sqe); 5124 5124 bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; 5125 5125 void __user *argp = (void __user *)(unsigned long)header->addr; 5126 5126 char *dev_path = NULL; ··· 5135 5137 * know if the specified device is created as unprivileged 5136 5138 * mode. 5137 5139 */ 5138 - if (_IOC_NR(cmd->cmd_op) != UBLK_CMD_GET_DEV_INFO2) 5140 + if (_IOC_NR(cmd_op) != UBLK_CMD_GET_DEV_INFO2) 5139 5141 return 0; 5140 5142 } 5141 5143 ··· 5156 5158 return PTR_ERR(dev_path); 5157 5159 5158 5160 ret = -EINVAL; 5159 - switch (_IOC_NR(cmd->cmd_op)) { 5161 + switch (_IOC_NR(cmd_op)) { 5160 5162 case UBLK_CMD_GET_DEV_INFO: 5161 5163 case UBLK_CMD_GET_DEV_INFO2: 5162 5164 case UBLK_CMD_GET_QUEUE_AFFINITY: ··· 5186 5188 header->addr += header->dev_path_len; 5187 5189 } 5188 5190 pr_devel("%s: dev id %d cmd_op %x uid %d gid %d path %s ret %d\n", 5189 - __func__, ub->ub_number, cmd->cmd_op, 5191 + __func__, ub->ub_number, cmd_op, 5190 5192 ub->dev_info.owner_uid, ub->dev_info.owner_gid, 5191 5193 dev_path, ret); 5192 5194 exit: ··· 5210 5212 static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, 5211 5213 unsigned int issue_flags) 5212 5214 { 5213 - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); 5215 + /* May point to userspace-mapped memory */ 5216 + const struct ublksrv_ctrl_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe); 5217 + struct ublksrv_ctrl_cmd header; 5214 5218 struct ublk_device *ub = NULL; 5215 5219 u32 cmd_op = cmd->cmd_op; 5216 5220 int ret = -EINVAL; ··· 5224 5224 if (!(issue_flags & IO_URING_F_SQE128)) 5225 5225 return -EINVAL; 5226 5226 5227 - ublk_ctrl_cmd_dump(cmd); 5227 + header.dev_id = READ_ONCE(ub_src->dev_id); 5228 + header.queue_id = READ_ONCE(ub_src->queue_id); 5229 + header.len = READ_ONCE(ub_src->len); 5230 + header.addr = READ_ONCE(ub_src->addr); 5231 + header.data[0] = READ_ONCE(ub_src->data[0]); 5232 + header.dev_path_len = READ_ONCE(ub_src->dev_path_len); 5233 + ublk_ctrl_cmd_dump(cmd_op, &header); 5228 5234 5229 5235 ret = ublk_check_cmd_op(cmd_op); 5230 5236 if (ret) 5231 5237 goto out; 5232 5238 5233 5239 if (cmd_op == UBLK_U_CMD_GET_FEATURES) { 5234 - ret = ublk_ctrl_get_features(header); 5240 + ret = ublk_ctrl_get_features(&header); 5235 5241 goto out; 5236 5242 } 5237 5243 5238 5244 if (_IOC_NR(cmd_op) != UBLK_CMD_ADD_DEV) { 5239 5245 ret = -ENODEV; 5240 - ub = ublk_get_device_from_id(header->dev_id); 5246 + ub = ublk_get_device_from_id(header.dev_id); 5241 5247 if (!ub) 5242 5248 goto out; 5243 5249 5244 - ret = ublk_ctrl_uring_cmd_permission(ub, cmd); 5250 + ret = ublk_ctrl_uring_cmd_permission(ub, cmd_op, &header); 5245 5251 if (ret) 5246 5252 goto put_dev; 5247 5253 } 5248 5254 5249 5255 switch (_IOC_NR(cmd_op)) { 5250 5256 case UBLK_CMD_START_DEV: 5251 - ret = ublk_ctrl_start_dev(ub, header); 5257 + ret = ublk_ctrl_start_dev(ub, &header); 5252 5258 break; 5253 5259 case UBLK_CMD_STOP_DEV: 5254 5260 ublk_ctrl_stop_dev(ub); ··· 5262 5256 break; 5263 5257 case UBLK_CMD_GET_DEV_INFO: 5264 5258 case UBLK_CMD_GET_DEV_INFO2: 5265 - ret = ublk_ctrl_get_dev_info(ub, header); 5259 + ret = ublk_ctrl_get_dev_info(ub, &header); 5266 5260 break; 5267 5261 case UBLK_CMD_ADD_DEV: 5268 - ret = ublk_ctrl_add_dev(header); 5262 + ret = ublk_ctrl_add_dev(&header); 5269 5263 break; 5270 5264 case UBLK_CMD_DEL_DEV: 5271 5265 ret = ublk_ctrl_del_dev(&ub, true); ··· 5274 5268 ret = ublk_ctrl_del_dev(&ub, false); 5275 5269 break; 5276 5270 case UBLK_CMD_GET_QUEUE_AFFINITY: 5277 - ret = ublk_ctrl_get_queue_affinity(ub, header); 5271 + ret = ublk_ctrl_get_queue_affinity(ub, &header); 5278 5272 break; 5279 5273 case UBLK_CMD_GET_PARAMS: 5280 - ret = ublk_ctrl_get_params(ub, header); 5274 + ret = ublk_ctrl_get_params(ub, &header); 5281 5275 break; 5282 5276 case UBLK_CMD_SET_PARAMS: 5283 - ret = ublk_ctrl_set_params(ub, header); 5277 + ret = ublk_ctrl_set_params(ub, &header); 5284 5278 break; 5285 5279 case UBLK_CMD_START_USER_RECOVERY: 5286 - ret = ublk_ctrl_start_recovery(ub, header); 5280 + ret = ublk_ctrl_start_recovery(ub, &header); 5287 5281 break; 5288 5282 case UBLK_CMD_END_USER_RECOVERY: 5289 - ret = ublk_ctrl_end_recovery(ub, header); 5283 + ret = ublk_ctrl_end_recovery(ub, &header); 5290 5284 break; 5291 5285 case UBLK_CMD_UPDATE_SIZE: 5292 - ublk_ctrl_set_size(ub, header); 5286 + ublk_ctrl_set_size(ub, &header); 5293 5287 ret = 0; 5294 5288 break; 5295 5289 case UBLK_CMD_QUIESCE_DEV: 5296 - ret = ublk_ctrl_quiesce_dev(ub, header); 5290 + ret = ublk_ctrl_quiesce_dev(ub, &header); 5297 5291 break; 5298 5292 case UBLK_CMD_TRY_STOP_DEV: 5299 5293 ret = ublk_ctrl_try_stop_dev(ub); ··· 5308 5302 ublk_put_device(ub); 5309 5303 out: 5310 5304 pr_devel("%s: cmd done ret %d cmd_op %x, dev id %d qid %d\n", 5311 - __func__, ret, cmd->cmd_op, header->dev_id, header->queue_id); 5305 + __func__, ret, cmd_op, header.dev_id, header.queue_id); 5312 5306 return ret; 5313 5307 } 5314 5308