[PATCH 5.19 1/1] io_uring: explicit sqe padding for ioctl commands

[PATCH 5.19 1/1] io_uring: explicit sqe padding for ioctl commands

[Pavel Begunkov]

32 bit sqe->cmd_op is an union with 64 bit values. It's always a good
idea to do padding explicitly. Also zero check it in prep, so it can be
used in the future if needed without compatibility concerns.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c                 | 2 +-
 include/uapi/linux/io_uring.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 0d491ad15b66..3b5e798524e5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5066,7 +5066,7 @@ static int io_uring_cmd_prep(struct io_kiocb *req,
 {
 	struct io_uring_cmd *ioucmd = &req->uring_cmd;
 
-	if (sqe->rw_flags)
+	if (sqe->rw_flags | sqe->__pad1)
 		return -EINVAL;
 	ioucmd->cmd = sqe->cmd;
 	ioucmd->cmd_op = READ_ONCE(sqe->cmd_op);
diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index f10b59d6693e..0ad3da28d2fc 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -22,7 +22,10 @@ struct io_uring_sqe {
 	union {
 		__u64	off;	/* offset into file */
 		__u64	addr2;
-		__u32	cmd_op;
+		struct {
+			__u32	cmd_op;
+			__u32	__pad1;
+		};
 	};
 	union {
 		__u64	addr;	/* pointer to buffer or iovecs */
-- 
2.36.1

Re: [PATCH 5.19 1/1] io_uring: explicit sqe padding for ioctl commands

[Jens Axboe]

On 7/7/22 8:00 AM, Pavel Begunkov wrote:
> 32 bit sqe->cmd_op is an union with 64 bit values. It's always a good
> idea to do padding explicitly. Also zero check it in prep, so it can be
> used in the future if needed without compatibility concerns.
> 
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  fs/io_uring.c                 | 2 +-
>  include/uapi/linux/io_uring.h | 5 ++++-
>  2 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 0d491ad15b66..3b5e798524e5 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -5066,7 +5066,7 @@ static int io_uring_cmd_prep(struct io_kiocb *req,
>  {
>  	struct io_uring_cmd *ioucmd = &req->uring_cmd;
>  
> -	if (sqe->rw_flags)
> +	if (sqe->rw_flags | sqe->__pad1)

Applied, but this changed to a logical OR instead.

-- 
Jens Axboe