Re: [PATCH] io_uring: zero remained bytes when reading to fixed kernel buffer

[Caleb Sander Mateos <csander@purestorage.com>]

On Sat, Mar 22, 2025 at 12:56 AM Ming Lei <ming.lei@redhat.com> wrote:
>
> So far fixed kernel buffer is only used for FS read/write, in which
> the remained bytes need to be zeroed in case of short read, otherwise
> kernel data may be leaked to userspace.

I'm not sure I have all the background to understand whether kernel
data can be leaked through ublk requests, but I share Pavel and
Keith's questions about whether this scenario is even possible. If it
is possible, I don't think this patch would cover all the affected
cases:
- Registered ublk buffers can be used with any io_uring operation, not
just read/write. Wouldn't the same issue apply when using the ublk
buffer with, say, a socket recv or an NVMe passthru operation?
- Wouldn't the same issue apply if the ublk server completes a ublk
read request without performing any I/O (zero-copy or not) to read
data into its buffer?

Best,
Caleb