* [PATCH 0/2] io_uring: Add macro to validate SQE cmd size
@ 2026-01-29 20:13 Govindarajulu Varadarajan
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan
0 siblings, 2 replies; 6+ messages in thread
From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw)
To: io-uring, axboe
Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan
This patch series introduces macros IO_URING_SQE_CMD() and
IO_URING_SQE128_CMD() for accessing cmd struct from io_uring SQEs,
providing compile-time type checking and size validation. The series
also updates ublk driver to check the SQE128 flag before accessing the
cmd structure.
Testing:
- Compile test only. (trivial changes)
- Validated IO_URING_SQE_CMD() and IO_URING_SQE128_CMD() with struct
size < 16, = 16, > 16 for IO_URING_SQE_CMD() and < 80, = 80, > 80 for
IO_URING_SQE128_CMD().
Govindarajulu Varadarajan (2):
io_uring: Add size check for sqe->cmd
block/ublk_drv: Validate SQE128 flag before accessing the cmd
drivers/block/ublk_drv.c | 20 +++++++++++---------
drivers/nvme/host/ioctl.c | 2 +-
fs/fuse/dev_uring.c | 6 ++++--
include/linux/io_uring/cmd.h | 15 +++++++++++----
4 files changed, 27 insertions(+), 16 deletions(-)
--
2.52.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] io_uring: Add size check for sqe->cmd
2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan
@ 2026-01-29 20:13 ` Govindarajulu Varadarajan
2026-01-29 20:19 ` Jens Axboe
` (2 more replies)
2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan
1 sibling, 3 replies; 6+ messages in thread
From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw)
To: io-uring, axboe
Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan
For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
check if size of user struct does not exceed 80 bytes at compile time.
User doesn't have to track this manually during development.
Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct
size for 16 bytes cmd.
Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
---
drivers/block/ublk_drv.c | 14 ++++++++------
drivers/nvme/host/ioctl.c | 2 +-
fs/fuse/dev_uring.c | 6 ++++--
include/linux/io_uring/cmd.h | 15 +++++++++++----
4 files changed, 24 insertions(+), 13 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 4265b7610c95..7c8a23709efa 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -3155,7 +3155,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
unsigned int issue_flags)
{
/* May point to userspace-mapped memory */
- const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
+ const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd);
u16 buf_idx = UBLK_INVALID_BUF_IDX;
struct ublk_device *ub = cmd->file->private_data;
struct ublk_queue *ubq;
@@ -3735,7 +3735,7 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data)
static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
unsigned int issue_flags)
{
- const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe);
+ const struct ublksrv_io_cmd *ub_cmd = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd);
struct ublk_device *ub = cmd->file->private_data;
unsigned tag = READ_ONCE(ub_cmd->tag);
unsigned q_id = READ_ONCE(ub_cmd->q_id);
@@ -3764,7 +3764,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd,
unsigned int issue_flags)
{
- const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe);
+ const struct ublk_batch_io *uc = IO_URING_SQE_CMD(cmd->sqe, struct ublk_batch_io);
struct ublk_device *ub = cmd->file->private_data;
struct ublk_batch_io_data data = {
.ub = ub,
@@ -4653,7 +4653,8 @@ static int ublk_ctrl_del_dev(struct ublk_device **p_ub, bool wait)
static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd)
{
- const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
+ const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe,
+ struct ublksrv_ctrl_cmd);
pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n",
__func__, cmd->cmd_op, header->dev_id, header->queue_id,
@@ -5061,7 +5062,7 @@ static int ublk_char_dev_permission(struct ublk_device *ub,
static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub,
struct io_uring_cmd *cmd)
{
- struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)io_uring_sqe_cmd(cmd->sqe);
+ struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, struct ublksrv_ctrl_cmd);
bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV;
void __user *argp = (void __user *)(unsigned long)header->addr;
char *dev_path = NULL;
@@ -5152,7 +5153,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op)
static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
unsigned int issue_flags)
{
- const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
+ const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe,
+ struct ublksrv_ctrl_cmd);
struct ublk_device *ub = NULL;
u32 cmd_op = cmd->cmd_op;
int ret = -EINVAL;
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index fb62633ccbb0..90c49bb727ad 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -447,7 +447,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec)
{
struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
- const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe);
+ const struct nvme_uring_cmd *cmd = IO_URING_SQE128_CMD(ioucmd->sqe, struct nvme_uring_cmd);
struct request_queue *q = ns ? ns->queue : ctrl->admin_q;
struct nvme_uring_data d;
struct nvme_command c;
diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
index 5ceb217ced1b..7dddba72f406 100644
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent)
static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,
struct fuse_conn *fc)
{
- const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
+ const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe,
+ struct fuse_uring_cmd_req);
struct fuse_ring_ent *ent;
int err;
struct fuse_ring *ring = fc->ring;
@@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
static int fuse_uring_register(struct io_uring_cmd *cmd,
unsigned int issue_flags, struct fuse_conn *fc)
{
- const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
+ const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe,
+ struct fuse_uring_cmd_req);
struct fuse_ring *ring = smp_load_acquire(&fc->ring);
struct fuse_ring_queue *queue;
struct fuse_ring_ent *ent;
diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h
index 375fd048c4cb..e8fd93e90cde 100644
--- a/include/linux/io_uring/cmd.h
+++ b/include/linux/io_uring/cmd.h
@@ -20,10 +20,17 @@ struct io_uring_cmd {
u8 unused[8];
};
-static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)
-{
- return sqe->cmd;
-}
+#define IO_URING_SQE128_CMD(sqe, type) ({ \
+ BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \
+ offsetof(struct io_uring_sqe, cmd))); \
+ (type *)(sqe)->cmd; \
+})
+
+#define IO_URING_SQE_CMD(sqe, type) ({ \
+ BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \
+ offsetof(struct io_uring_sqe, cmd))); \
+ (type *)(sqe)->cmd; \
+})
static inline void io_uring_cmd_private_sz_check(size_t cmd_sz)
{
--
2.52.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd
2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
@ 2026-01-29 20:13 ` Govindarajulu Varadarajan
1 sibling, 0 replies; 6+ messages in thread
From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw)
To: io-uring, axboe
Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan
ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before
IO_URING_F_SQE128 flag check. This could cause out of boundary memory
access.
Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return
-EINVAL immediately if the flag is not set.
Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
---
drivers/block/ublk_drv.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 7c8a23709efa..adeed0af1dee 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -5163,10 +5163,10 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
issue_flags & IO_URING_F_NONBLOCK)
return -EAGAIN;
- ublk_ctrl_cmd_dump(cmd);
-
if (!(issue_flags & IO_URING_F_SQE128))
- goto out;
+ return -EINVAL;
+
+ ublk_ctrl_cmd_dump(cmd);
ret = ublk_check_cmd_op(cmd_op);
if (ret)
--
2.52.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
@ 2026-01-29 20:19 ` Jens Axboe
2026-01-29 20:48 ` Caleb Sander Mateos
2026-01-30 5:11 ` Christoph Hellwig
2 siblings, 0 replies; 6+ messages in thread
From: Jens Axboe @ 2026-01-29 20:19 UTC (permalink / raw)
To: Govindarajulu Varadarajan, io-uring; +Cc: ming.lei, kbusch, hch, sagi, miklos
On 1/29/26 1:13 PM, Govindarajulu Varadarajan wrote:
> For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
> check if size of user struct does not exceed 80 bytes at compile time.
> User doesn't have to track this manually during development.
>
> Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct
> size for 16 bytes cmd.
Can't we just retain the normal lower case one and add the check? That's
what we do for normal inside sqe data, with io_kiocb_to_cmd(). There
should be no need for all-caps here.
--
Jens Axboe
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
2026-01-29 20:19 ` Jens Axboe
@ 2026-01-29 20:48 ` Caleb Sander Mateos
2026-01-30 5:11 ` Christoph Hellwig
2 siblings, 0 replies; 6+ messages in thread
From: Caleb Sander Mateos @ 2026-01-29 20:48 UTC (permalink / raw)
To: Govindarajulu Varadarajan
Cc: io-uring, axboe, ming.lei, kbusch, hch, sagi, miklos
On Thu, Jan 29, 2026 at 12:14 PM Govindarajulu Varadarajan
<govind.varadar@gmail.com> wrote:
>
> For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
> check if size of user struct does not exceed 80 bytes at compile time.
> User doesn't have to track this manually during development.
>
> Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct
> size for 16 bytes cmd.
>
> Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
> ---
> drivers/block/ublk_drv.c | 14 ++++++++------
> drivers/nvme/host/ioctl.c | 2 +-
> fs/fuse/dev_uring.c | 6 ++++--
> include/linux/io_uring/cmd.h | 15 +++++++++++----
> 4 files changed, 24 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 4265b7610c95..7c8a23709efa 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -3155,7 +3155,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> /* May point to userspace-mapped memory */
> - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd);
> u16 buf_idx = UBLK_INVALID_BUF_IDX;
> struct ublk_device *ub = cmd->file->private_data;
> struct ublk_queue *ubq;
> @@ -3735,7 +3735,7 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data)
> static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_io_cmd *ub_cmd = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd);
> struct ublk_device *ub = cmd->file->private_data;
> unsigned tag = READ_ONCE(ub_cmd->tag);
> unsigned q_id = READ_ONCE(ub_cmd->q_id);
> @@ -3764,7 +3764,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
> static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublk_batch_io *uc = IO_URING_SQE_CMD(cmd->sqe, struct ublk_batch_io);
> struct ublk_device *ub = cmd->file->private_data;
> struct ublk_batch_io_data data = {
> .ub = ub,
> @@ -4653,7 +4653,8 @@ static int ublk_ctrl_del_dev(struct ublk_device **p_ub, bool wait)
>
> static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd)
> {
> - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe,
> + struct ublksrv_ctrl_cmd);
>
> pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n",
> __func__, cmd->cmd_op, header->dev_id, header->queue_id,
> @@ -5061,7 +5062,7 @@ static int ublk_char_dev_permission(struct ublk_device *ub,
> static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub,
> struct io_uring_cmd *cmd)
> {
> - struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)io_uring_sqe_cmd(cmd->sqe);
> + struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, struct ublksrv_ctrl_cmd);
> bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV;
> void __user *argp = (void __user *)(unsigned long)header->addr;
> char *dev_path = NULL;
> @@ -5152,7 +5153,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op)
> static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe,
> + struct ublksrv_ctrl_cmd);
> struct ublk_device *ub = NULL;
> u32 cmd_op = cmd->cmd_op;
> int ret = -EINVAL;
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index fb62633ccbb0..90c49bb727ad 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -447,7 +447,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
> struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec)
> {
> struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
> - const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe);
> + const struct nvme_uring_cmd *cmd = IO_URING_SQE128_CMD(ioucmd->sqe, struct nvme_uring_cmd);
Some of these lines are quite long
> struct request_queue *q = ns ? ns->queue : ctrl->admin_q;
> struct nvme_uring_data d;
> struct nvme_command c;
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index 5ceb217ced1b..7dddba72f406 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent)
> static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,
> struct fuse_conn *fc)
> {
> - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
> + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe,
> + struct fuse_uring_cmd_req);
> struct fuse_ring_ent *ent;
> int err;
> struct fuse_ring *ring = fc->ring;
> @@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
> static int fuse_uring_register(struct io_uring_cmd *cmd,
> unsigned int issue_flags, struct fuse_conn *fc)
> {
> - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
> + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe,
> + struct fuse_uring_cmd_req);
> struct fuse_ring *ring = smp_load_acquire(&fc->ring);
> struct fuse_ring_queue *queue;
> struct fuse_ring_ent *ent;
> diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h
> index 375fd048c4cb..e8fd93e90cde 100644
> --- a/include/linux/io_uring/cmd.h
> +++ b/include/linux/io_uring/cmd.h
> @@ -20,10 +20,17 @@ struct io_uring_cmd {
> u8 unused[8];
> };
>
> -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)
> -{
> - return sqe->cmd;
> -}
> +#define IO_URING_SQE128_CMD(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \
> + offsetof(struct io_uring_sqe, cmd))); \
> + (type *)(sqe)->cmd; \
> +})
> +
> +#define IO_URING_SQE_CMD(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \
> + offsetof(struct io_uring_sqe, cmd))); \
> + (type *)(sqe)->cmd;
Can we continue to return a const pointer? It would be buggy for a
uring_cmd implementation to write to the the io_uring_sqe, which may
live in userspace-mapped memory.
Best,
Caleb
\
> +})
>
> static inline void io_uring_cmd_private_sz_check(size_t cmd_sz)
> {
> --
> 2.52.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
2026-01-29 20:19 ` Jens Axboe
2026-01-29 20:48 ` Caleb Sander Mateos
@ 2026-01-30 5:11 ` Christoph Hellwig
2 siblings, 0 replies; 6+ messages in thread
From: Christoph Hellwig @ 2026-01-30 5:11 UTC (permalink / raw)
To: Govindarajulu Varadarajan
Cc: io-uring, axboe, ming.lei, kbusch, hch, sagi, miklos
On Thu, Jan 29, 2026 at 12:13:46PM -0800, Govindarajulu Varadarajan wrote:
> - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd);
As Jens already said, no need for the shouting. Also please break the
lines to keep things readable.
> -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)
> -{
> - return sqe->cmd;
> -}
> +#define IO_URING_SQE128_CMD(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \
> + offsetof(struct io_uring_sqe, cmd))); \
> + (type *)(sqe)->cmd; \
> +})
> +
> +#define IO_URING_SQE_CMD(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \
> + offsetof(struct io_uring_sqe, cmd))); \
> + (type *)(sqe)->cmd; \
> +})
I'm also not sure adding a BUILD_BUG_ON to every derefence is great for
compile times. But I'm not really sure what would be a good other
place for it.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-01-30 5:11 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan
2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
2026-01-29 20:19 ` Jens Axboe
2026-01-29 20:48 ` Caleb Sander Mateos
2026-01-30 5:11 ` Christoph Hellwig
2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox