Re: [PATCH v1 1/2] io-uring: add io_uring_cmd_get_buffer_info()

[Caleb Sander Mateos <csander@purestorage.com>]

On Wed, Oct 22, 2025 at 1:23 PM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> Add io_uring_cmd_get_buffer_info() to fetch buffer information that will
> be necessary for constructing an iov iter for it.
>
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  include/linux/io_uring/cmd.h |  2 ++
>  io_uring/rsrc.c              | 21 +++++++++++++++++++++
>  2 files changed, 23 insertions(+)
>
> diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h
> index 7509025b4071..a92e810f37f9 100644
> --- a/include/linux/io_uring/cmd.h
> +++ b/include/linux/io_uring/cmd.h
> @@ -177,4 +177,6 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq,
>  int io_buffer_unregister_bvec(struct io_uring_cmd *cmd, unsigned int index,
>                               unsigned int issue_flags);
>
> +int io_uring_cmd_get_buffer_info(struct io_uring_cmd *cmd, u64 *ubuf,
> +                                unsigned int *len);
>  #endif /* _LINUX_IO_URING_CMD_H */
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index d787c16dc1c3..8554cdad8abc 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1569,3 +1569,24 @@ int io_prep_reg_iovec(struct io_kiocb *req, struct iou_vec *iv,
>         req->flags |= REQ_F_IMPORT_BUFFER;
>         return 0;
>  }
> +
> +int io_uring_cmd_get_buffer_info(struct io_uring_cmd *cmd, u64 *ubuf,
> +                                unsigned int *len)
> +{
> +       struct io_ring_ctx *ctx = cmd_to_io_kiocb(cmd)->ctx;
> +       struct io_rsrc_data *data = &ctx->buf_table;
> +       struct io_mapped_ubuf *imu;
> +       unsigned int buf_index;
> +
> +       if (!data->nr)
> +               return -EINVAL;
> +
> +       buf_index = cmd->sqe->buf_index;

This is reading userspace-mapped memory, it should use READ_ONCE().
But why not just use cmd_to_io_kiocb(cmd)->buf_index? That's already
sampled from the SQE in io_uring_cmd_prep() if the
IORING_URING_CMD_FIXED flag is set. And it seems like the fuse
uring_cmd implementation requires that flag to be set.

> +       imu = data->nodes[buf_index]->buf;

Needs a bounds check?

> +
> +       *ubuf = imu->ubuf;
> +       *len = imu->len;

This wouldn't be valid for kernel registered buffers (those registered
with io_buffer_register_bvec()). Either reject those or return a more
general representation of the registered buffer memory (e.g. an
iterator)?

Best,
Caleb

> +
> +       return 0;
> +}
> +EXPORT_SYMBOL_GPL(io_uring_cmd_get_buffer_info);
> --
> 2.47.3
>
>