* [PATCH 0/2] io_uring: Add macro to validate SQE cmd size @ 2026-01-29 20:13 Govindarajulu Varadarajan 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan 2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan 0 siblings, 2 replies; 6+ messages in thread From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw) To: io-uring, axboe Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan This patch series introduces macros IO_URING_SQE_CMD() and IO_URING_SQE128_CMD() for accessing cmd struct from io_uring SQEs, providing compile-time type checking and size validation. The series also updates ublk driver to check the SQE128 flag before accessing the cmd structure. Testing: - Compile test only. (trivial changes) - Validated IO_URING_SQE_CMD() and IO_URING_SQE128_CMD() with struct size < 16, = 16, > 16 for IO_URING_SQE_CMD() and < 80, = 80, > 80 for IO_URING_SQE128_CMD(). Govindarajulu Varadarajan (2): io_uring: Add size check for sqe->cmd block/ublk_drv: Validate SQE128 flag before accessing the cmd drivers/block/ublk_drv.c | 20 +++++++++++--------- drivers/nvme/host/ioctl.c | 2 +- fs/fuse/dev_uring.c | 6 ++++-- include/linux/io_uring/cmd.h | 15 +++++++++++---- 4 files changed, 27 insertions(+), 16 deletions(-) -- 2.52.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] io_uring: Add size check for sqe->cmd 2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan @ 2026-01-29 20:13 ` Govindarajulu Varadarajan 2026-01-29 20:19 ` Jens Axboe ` (2 more replies) 2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan 1 sibling, 3 replies; 6+ messages in thread From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw) To: io-uring, axboe Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to check if size of user struct does not exceed 80 bytes at compile time. User doesn't have to track this manually during development. Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct size for 16 bytes cmd. Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com> --- drivers/block/ublk_drv.c | 14 ++++++++------ drivers/nvme/host/ioctl.c | 2 +- fs/fuse/dev_uring.c | 6 ++++-- include/linux/io_uring/cmd.h | 15 +++++++++++---- 4 files changed, 24 insertions(+), 13 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 4265b7610c95..7c8a23709efa 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -3155,7 +3155,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, unsigned int issue_flags) { /* May point to userspace-mapped memory */ - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd); u16 buf_idx = UBLK_INVALID_BUF_IDX; struct ublk_device *ub = cmd->file->private_data; struct ublk_queue *ubq; @@ -3735,7 +3735,7 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data) static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_io_cmd *ub_cmd = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd); struct ublk_device *ub = cmd->file->private_data; unsigned tag = READ_ONCE(ub_cmd->tag); unsigned q_id = READ_ONCE(ub_cmd->q_id); @@ -3764,7 +3764,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe); + const struct ublk_batch_io *uc = IO_URING_SQE_CMD(cmd->sqe, struct ublk_batch_io); struct ublk_device *ub = cmd->file->private_data; struct ublk_batch_io_data data = { .ub = ub, @@ -4653,7 +4653,8 @@ static int ublk_ctrl_del_dev(struct ublk_device **p_ub, bool wait) static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd) { - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, + struct ublksrv_ctrl_cmd); pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n", __func__, cmd->cmd_op, header->dev_id, header->queue_id, @@ -5061,7 +5062,7 @@ static int ublk_char_dev_permission(struct ublk_device *ub, static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, struct io_uring_cmd *cmd) { - struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)io_uring_sqe_cmd(cmd->sqe); + struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, struct ublksrv_ctrl_cmd); bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; void __user *argp = (void __user *)(unsigned long)header->addr; char *dev_path = NULL; @@ -5152,7 +5153,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op) static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, + struct ublksrv_ctrl_cmd); struct ublk_device *ub = NULL; u32 cmd_op = cmd->cmd_op; int ret = -EINVAL; diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index fb62633ccbb0..90c49bb727ad 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -447,7 +447,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec) { struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); - const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe); + const struct nvme_uring_cmd *cmd = IO_URING_SQE128_CMD(ioucmd->sqe, struct nvme_uring_cmd); struct request_queue *q = ns ? ns->queue : ctrl->admin_q; struct nvme_uring_data d; struct nvme_command c; diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c index 5ceb217ced1b..7dddba72f406 100644 --- a/fs/fuse/dev_uring.c +++ b/fs/fuse/dev_uring.c @@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent) static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags, struct fuse_conn *fc) { - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe, + struct fuse_uring_cmd_req); struct fuse_ring_ent *ent; int err; struct fuse_ring *ring = fc->ring; @@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd, static int fuse_uring_register(struct io_uring_cmd *cmd, unsigned int issue_flags, struct fuse_conn *fc) { - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe, + struct fuse_uring_cmd_req); struct fuse_ring *ring = smp_load_acquire(&fc->ring); struct fuse_ring_queue *queue; struct fuse_ring_ent *ent; diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h index 375fd048c4cb..e8fd93e90cde 100644 --- a/include/linux/io_uring/cmd.h +++ b/include/linux/io_uring/cmd.h @@ -20,10 +20,17 @@ struct io_uring_cmd { u8 unused[8]; }; -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe) -{ - return sqe->cmd; -} +#define IO_URING_SQE128_CMD(sqe, type) ({ \ + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \ + offsetof(struct io_uring_sqe, cmd))); \ + (type *)(sqe)->cmd; \ +}) + +#define IO_URING_SQE_CMD(sqe, type) ({ \ + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \ + offsetof(struct io_uring_sqe, cmd))); \ + (type *)(sqe)->cmd; \ +}) static inline void io_uring_cmd_private_sz_check(size_t cmd_sz) { -- 2.52.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan @ 2026-01-29 20:19 ` Jens Axboe 2026-01-29 20:48 ` Caleb Sander Mateos 2026-01-30 5:11 ` Christoph Hellwig 2 siblings, 0 replies; 6+ messages in thread From: Jens Axboe @ 2026-01-29 20:19 UTC (permalink / raw) To: Govindarajulu Varadarajan, io-uring; +Cc: ming.lei, kbusch, hch, sagi, miklos On 1/29/26 1:13 PM, Govindarajulu Varadarajan wrote: > For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to > check if size of user struct does not exceed 80 bytes at compile time. > User doesn't have to track this manually during development. > > Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct > size for 16 bytes cmd. Can't we just retain the normal lower case one and add the check? That's what we do for normal inside sqe data, with io_kiocb_to_cmd(). There should be no need for all-caps here. -- Jens Axboe ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan 2026-01-29 20:19 ` Jens Axboe @ 2026-01-29 20:48 ` Caleb Sander Mateos 2026-01-30 5:11 ` Christoph Hellwig 2 siblings, 0 replies; 6+ messages in thread From: Caleb Sander Mateos @ 2026-01-29 20:48 UTC (permalink / raw) To: Govindarajulu Varadarajan Cc: io-uring, axboe, ming.lei, kbusch, hch, sagi, miklos On Thu, Jan 29, 2026 at 12:14 PM Govindarajulu Varadarajan <govind.varadar@gmail.com> wrote: > > For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to > check if size of user struct does not exceed 80 bytes at compile time. > User doesn't have to track this manually during development. > > Replace io_uring_sqe_cmd() with IO_URING_SQE_CMD() which checks struct > size for 16 bytes cmd. > > Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com> > --- > drivers/block/ublk_drv.c | 14 ++++++++------ > drivers/nvme/host/ioctl.c | 2 +- > fs/fuse/dev_uring.c | 6 ++++-- > include/linux/io_uring/cmd.h | 15 +++++++++++---- > 4 files changed, 24 insertions(+), 13 deletions(-) > > diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c > index 4265b7610c95..7c8a23709efa 100644 > --- a/drivers/block/ublk_drv.c > +++ b/drivers/block/ublk_drv.c > @@ -3155,7 +3155,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, > unsigned int issue_flags) > { > /* May point to userspace-mapped memory */ > - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe); > + const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd); > u16 buf_idx = UBLK_INVALID_BUF_IDX; > struct ublk_device *ub = cmd->file->private_data; > struct ublk_queue *ubq; > @@ -3735,7 +3735,7 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data) > static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, > unsigned int issue_flags) > { > - const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe); > + const struct ublksrv_io_cmd *ub_cmd = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd); > struct ublk_device *ub = cmd->file->private_data; > unsigned tag = READ_ONCE(ub_cmd->tag); > unsigned q_id = READ_ONCE(ub_cmd->q_id); > @@ -3764,7 +3764,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, > static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd, > unsigned int issue_flags) > { > - const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe); > + const struct ublk_batch_io *uc = IO_URING_SQE_CMD(cmd->sqe, struct ublk_batch_io); > struct ublk_device *ub = cmd->file->private_data; > struct ublk_batch_io_data data = { > .ub = ub, > @@ -4653,7 +4653,8 @@ static int ublk_ctrl_del_dev(struct ublk_device **p_ub, bool wait) > > static inline void ublk_ctrl_cmd_dump(struct io_uring_cmd *cmd) > { > - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); > + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, > + struct ublksrv_ctrl_cmd); > > pr_devel("%s: cmd_op %x, dev id %d qid %d data %llx buf %llx len %u\n", > __func__, cmd->cmd_op, header->dev_id, header->queue_id, > @@ -5061,7 +5062,7 @@ static int ublk_char_dev_permission(struct ublk_device *ub, > static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, > struct io_uring_cmd *cmd) > { > - struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)io_uring_sqe_cmd(cmd->sqe); > + struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, struct ublksrv_ctrl_cmd); > bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; > void __user *argp = (void __user *)(unsigned long)header->addr; > char *dev_path = NULL; > @@ -5152,7 +5153,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op) > static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, > unsigned int issue_flags) > { > - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); > + const struct ublksrv_ctrl_cmd *header = IO_URING_SQE128_CMD(cmd->sqe, > + struct ublksrv_ctrl_cmd); > struct ublk_device *ub = NULL; > u32 cmd_op = cmd->cmd_op; > int ret = -EINVAL; > diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c > index fb62633ccbb0..90c49bb727ad 100644 > --- a/drivers/nvme/host/ioctl.c > +++ b/drivers/nvme/host/ioctl.c > @@ -447,7 +447,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, > struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec) > { > struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); > - const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe); > + const struct nvme_uring_cmd *cmd = IO_URING_SQE128_CMD(ioucmd->sqe, struct nvme_uring_cmd); Some of these lines are quite long > struct request_queue *q = ns ? ns->queue : ctrl->admin_q; > struct nvme_uring_data d; > struct nvme_command c; > diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c > index 5ceb217ced1b..7dddba72f406 100644 > --- a/fs/fuse/dev_uring.c > +++ b/fs/fuse/dev_uring.c > @@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent) > static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags, > struct fuse_conn *fc) > { > - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); > + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe, > + struct fuse_uring_cmd_req); > struct fuse_ring_ent *ent; > int err; > struct fuse_ring *ring = fc->ring; > @@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd, > static int fuse_uring_register(struct io_uring_cmd *cmd, > unsigned int issue_flags, struct fuse_conn *fc) > { > - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); > + const struct fuse_uring_cmd_req *cmd_req = IO_URING_SQE128_CMD(cmd->sqe, > + struct fuse_uring_cmd_req); > struct fuse_ring *ring = smp_load_acquire(&fc->ring); > struct fuse_ring_queue *queue; > struct fuse_ring_ent *ent; > diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h > index 375fd048c4cb..e8fd93e90cde 100644 > --- a/include/linux/io_uring/cmd.h > +++ b/include/linux/io_uring/cmd.h > @@ -20,10 +20,17 @@ struct io_uring_cmd { > u8 unused[8]; > }; > > -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe) > -{ > - return sqe->cmd; > -} > +#define IO_URING_SQE128_CMD(sqe, type) ({ \ > + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \ > + offsetof(struct io_uring_sqe, cmd))); \ > + (type *)(sqe)->cmd; \ > +}) > + > +#define IO_URING_SQE_CMD(sqe, type) ({ \ > + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \ > + offsetof(struct io_uring_sqe, cmd))); \ > + (type *)(sqe)->cmd; Can we continue to return a const pointer? It would be buggy for a uring_cmd implementation to write to the the io_uring_sqe, which may live in userspace-mapped memory. Best, Caleb \ > +}) > > static inline void io_uring_cmd_private_sz_check(size_t cmd_sz) > { > -- > 2.52.0 > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] io_uring: Add size check for sqe->cmd 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan 2026-01-29 20:19 ` Jens Axboe 2026-01-29 20:48 ` Caleb Sander Mateos @ 2026-01-30 5:11 ` Christoph Hellwig 2 siblings, 0 replies; 6+ messages in thread From: Christoph Hellwig @ 2026-01-30 5:11 UTC (permalink / raw) To: Govindarajulu Varadarajan Cc: io-uring, axboe, ming.lei, kbusch, hch, sagi, miklos On Thu, Jan 29, 2026 at 12:13:46PM -0800, Govindarajulu Varadarajan wrote: > - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe); > + const struct ublksrv_io_cmd *ub_src = IO_URING_SQE_CMD(cmd->sqe, struct ublksrv_io_cmd); As Jens already said, no need for the shouting. Also please break the lines to keep things readable. > -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe) > -{ > - return sqe->cmd; > -} > +#define IO_URING_SQE128_CMD(sqe, type) ({ \ > + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \ > + offsetof(struct io_uring_sqe, cmd))); \ > + (type *)(sqe)->cmd; \ > +}) > + > +#define IO_URING_SQE_CMD(sqe, type) ({ \ > + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \ > + offsetof(struct io_uring_sqe, cmd))); \ > + (type *)(sqe)->cmd; \ > +}) I'm also not sure adding a BUILD_BUG_ON to every derefence is great for compile times. But I'm not really sure what would be a good other place for it. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd 2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan @ 2026-01-29 20:13 ` Govindarajulu Varadarajan 1 sibling, 0 replies; 6+ messages in thread From: Govindarajulu Varadarajan @ 2026-01-29 20:13 UTC (permalink / raw) To: io-uring, axboe Cc: ming.lei, kbusch, hch, sagi, miklos, Govindarajulu Varadarajan ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set. Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com> --- drivers/block/ublk_drv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 7c8a23709efa..adeed0af1dee 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -5163,10 +5163,10 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, issue_flags & IO_URING_F_NONBLOCK) return -EAGAIN; - ublk_ctrl_cmd_dump(cmd); - if (!(issue_flags & IO_URING_F_SQE128)) - goto out; + return -EINVAL; + + ublk_ctrl_cmd_dump(cmd); ret = ublk_check_cmd_op(cmd_op); if (ret) -- 2.52.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-01-30 5:11 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-01-29 20:13 [PATCH 0/2] io_uring: Add macro to validate SQE cmd size Govindarajulu Varadarajan 2026-01-29 20:13 ` [PATCH 1/2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan 2026-01-29 20:19 ` Jens Axboe 2026-01-29 20:48 ` Caleb Sander Mateos 2026-01-30 5:11 ` Christoph Hellwig 2026-01-29 20:13 ` [PATCH 2/2] block/ublk_drv: Validate SQE128 flag before accessing the cmd Govindarajulu Varadarajan
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox