From: Caleb Sander Mateos <csander@purestorage.com>
To: Govindarajulu Varadarajan <govind.varadar@gmail.com>
Cc: io-uring@vger.kernel.org, axboe@kernel.dk, ming.lei@redhat.com,
kbusch@kernel.org, hch@lst.de, sagi@grimberg.me,
miklos@szeredi.hu
Subject: Re: [PATCH v2] io_uring: Add size check for sqe->cmd
Date: Thu, 29 Jan 2026 17:27:48 -0800 [thread overview]
Message-ID: <CADUfDZocbHofja6OTwsn7AZrYiqO=Osm=4ED4d2yd3_7Jv2-gA@mail.gmail.com> (raw)
In-Reply-To: <20260129235434.418973-1-govind.varadar@gmail.com>
On Thu, Jan 29, 2026 at 3:55 PM Govindarajulu Varadarajan
<govind.varadar@gmail.com> wrote:
>
> For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
> check if size of user struct does not exceed 80 bytes at compile time.
> User doesn't have to track this manually during development.
>
> Replace io_uring_sqe_cmd() inline func with macro and add
> io_uring_sqe128_cmd() which checks struct
> size for 16 bytes cmd and 80 bytes cmd respectively.
>
> Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
> ---
> v2:
> - Replace all caps macro with lower case definition.
> - Add const qualifier to return type.
> - Rebase on top of series "[PATCH 0/4] ublk: fix struct
> ublksrv_ctrl_cmd accesses"
>
> BRANCH: for-7.0/block
>
> Depends-on series: "[PATCH 0/4] ublk: fix struct ublksrv_ctrl_cmd
> accesses"
> Needs "[PATCH 2/4] ublk: don't write to struct ublksrv_ctrl_cmd" to
> avoid merge conflict.
> ---
> drivers/block/ublk_drv.c | 14 +++++++++-----
> drivers/nvme/host/ioctl.c | 3 ++-
> fs/fuse/dev_uring.c | 6 ++++--
> include/linux/io_uring/cmd.h | 15 +++++++++++----
> 4 files changed, 26 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 0e25a59849ae..3f9d6dc3afef 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -3244,7 +3244,8 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> /* May point to userspace-mapped memory */
> - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe,
> + struct ublksrv_io_cmd);
> u16 buf_idx = UBLK_INVALID_BUF_IDX;
> struct ublk_device *ub = cmd->file->private_data;
> struct ublk_queue *ubq;
> @@ -3824,7 +3825,8 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data)
> static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe,
> + struct ublksrv_io_cmd);
> struct ublk_device *ub = cmd->file->private_data;
> unsigned tag = READ_ONCE(ub_cmd->tag);
> unsigned q_id = READ_ONCE(ub_cmd->q_id);
> @@ -3853,7 +3855,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
> static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe, struct ublk_batch_io);
> struct ublk_device *ub = cmd->file->private_data;
> struct ublk_batch_io_data data = {
> .ub = ub,
> @@ -5106,7 +5108,8 @@ static int ublk_char_dev_permission(struct ublk_device *ub,
> static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub,
> struct io_uring_cmd *cmd, u64 *addr, u16 *len)
> {
> - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_ctrl_cmd *header = io_uring_sqe128_cmd(cmd->sqe,
> + struct ublksrv_ctrl_cmd);
> bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV;
> void __user *argp = (void __user *)*addr;
> char *dev_path = NULL;
> @@ -5199,7 +5202,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op)
> static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
> unsigned int issue_flags)
> {
> - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe);
> + const struct ublksrv_ctrl_cmd *header = io_uring_sqe128_cmd(cmd->sqe,
> + struct ublksrv_ctrl_cmd);
> struct ublk_device *ub = NULL;
> u32 cmd_op = cmd->cmd_op;
> int ret = -EINVAL;
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index fb62633ccbb0..8844bbd39515 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -447,7 +447,8 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
> struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec)
> {
> struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
> - const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe);
> + const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe,
> + struct nvme_uring_cmd);
> struct request_queue *q = ns ? ns->queue : ctrl->admin_q;
> struct nvme_uring_data d;
> struct nvme_command c;
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index 5ceb217ced1b..60f2058feb74 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent)
> static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,
> struct fuse_conn *fc)
> {
> - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
> + const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,
> + struct fuse_uring_cmd_req);
> struct fuse_ring_ent *ent;
> int err;
> struct fuse_ring *ring = fc->ring;
> @@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
> static int fuse_uring_register(struct io_uring_cmd *cmd,
> unsigned int issue_flags, struct fuse_conn *fc)
> {
> - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
> + const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,
> + struct fuse_uring_cmd_req);
> struct fuse_ring *ring = smp_load_acquire(&fc->ring);
> struct fuse_ring_queue *queue;
> struct fuse_ring_ent *ent;
> diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h
> index 375fd048c4cb..7245b975c55d 100644
> --- a/include/linux/io_uring/cmd.h
> +++ b/include/linux/io_uring/cmd.h
> @@ -20,10 +20,17 @@ struct io_uring_cmd {
> u8 unused[8];
> };
>
> -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)
> -{
> - return sqe->cmd;
> -}
> +#define io_uring_sqe128_cmd(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \
> + offsetof(struct io_uring_sqe, cmd))); \
> + (const type *)(sqe)->cmd; \
> +})
> +
> +#define io_uring_sqe_cmd(sqe, type) ({ \
> + BUILD_BUG_ON(sizeof(type) > ((sizeof(struct io_uring_sqe)) - \
Could remove the extra set of parens around sizeof(struct io_uring_sqe).
Other than that,
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
> + offsetof(struct io_uring_sqe, cmd))); \
> + (const type *)(sqe)->cmd; \
> +})
>
> static inline void io_uring_cmd_private_sz_check(size_t cmd_sz)
> {
> --
> 2.52.0
>
>
prev parent reply other threads:[~2026-01-30 1:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-29 23:54 [PATCH v2] io_uring: Add size check for sqe->cmd Govindarajulu Varadarajan
2026-01-30 1:27 ` Caleb Sander Mateos [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CADUfDZocbHofja6OTwsn7AZrYiqO=Osm=4ED4d2yd3_7Jv2-gA@mail.gmail.com' \
--to=csander@purestorage.com \
--cc=axboe@kernel.dk \
--cc=govind.varadar@gmail.com \
--cc=hch@lst.de \
--cc=io-uring@vger.kernel.org \
--cc=kbusch@kernel.org \
--cc=miklos@szeredi.hu \
--cc=ming.lei@redhat.com \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox