[PATCH 1/1] io_uring/cmd: warn on reg buf imports by ineligible cmds

[PATCH 1/1] io_uring/cmd: warn on reg buf imports by ineligible cmds

[Pavel Begunkov]

For IORING_URING_CMD_FIXED-less commands io_uring doesn't pull buf_index
from the sqe, so imports might succeed if the index coincide, e.g. when
it's 0, but otherwise it's error prone. Warn if someone tries to import
without the flag.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/uring_cmd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index 34b450c78e2b..05d946115b0a 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -270,6 +270,9 @@ int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw,
 {
 	struct io_kiocb *req = cmd_to_io_kiocb(ioucmd);
 
+	if (WARN_ON_ONCE(!(ioucmd->flags & IORING_URING_CMD_FIXED)))
+		return -EINVAL;
+
 	return io_import_reg_buf(req, iter, ubuf, len, rw, issue_flags);
 }
 EXPORT_SYMBOL_GPL(io_uring_cmd_import_fixed);
@@ -284,6 +287,9 @@ int io_uring_cmd_import_fixed_vec(struct io_uring_cmd *ioucmd,
 	struct io_async_cmd *ac = req->async_data;
 	int ret;
 
+	if (WARN_ON_ONCE(!(ioucmd->flags & IORING_URING_CMD_FIXED)))
+		return -EINVAL;
+
 	ret = io_prep_reg_iovec(req, &ac->vec, uvec, uvec_segs);
 	if (ret)
 		return ret;
-- 
2.49.0

Re: [PATCH 1/1] io_uring/cmd: warn on reg buf imports by ineligible cmds

[Anuj gupta]

Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>

Re: [PATCH 1/1] io_uring/cmd: warn on reg buf imports by ineligible cmds

[Jens Axboe]

On Fri, 23 May 2025 10:04:46 +0100, Pavel Begunkov wrote:
> For IORING_URING_CMD_FIXED-less commands io_uring doesn't pull buf_index
> from the sqe, so imports might succeed if the index coincide, e.g. when
> it's 0, but otherwise it's error prone. Warn if someone tries to import
> without the flag.
> 
> 

Applied, thanks!

[1/1] io_uring/cmd: warn on reg buf imports by ineligible cmds
      commit: 6faaf6e0faf1cc9a1359cfe6ecb4d9711b4a9f29

Best regards,
-- 
Jens Axboe