For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to check if size of user struct does not exceed 80 bytes at compile time. User doesn't have to track this manually during development. Replace io_uring_sqe_cmd() inline func with macro and add io_uring_sqe128_cmd() which checks struct size for 16 bytes cmd and 80 bytes cmd respectively. Signed-off-by: Govindarajulu Varadarajan --- v3: Remove extra parentheses. v2: - Replace all caps macro with lower case definition. - Add const qualifier to return type. - Rebase on top of series "[PATCH 0/4] ublk: fix struct ublksrv_ctrl_cmd accesses" BRANCH: for-7.0/block Depends-on series: "[PATCH 0/4] ublk: fix struct ublksrv_ctrl_cmd accesses" Needs "[PATCH 2/4] ublk: don't write to struct ublksrv_ctrl_cmd" to avoid merge conflict. --- drivers/block/ublk_drv.c | 14 +++++++++----- drivers/nvme/host/ioctl.c | 3 ++- fs/fuse/dev_uring.c | 6 ++++-- include/linux/io_uring/cmd.h | 15 +++++++++++---- 4 files changed, 26 insertions(+), 12 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 0e25a59849ae..3f9d6dc3afef 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -3244,7 +3244,8 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, unsigned int issue_flags) { /* May point to userspace-mapped memory */ - const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe, + struct ublksrv_io_cmd); u16 buf_idx = UBLK_INVALID_BUF_IDX; struct ublk_device *ub = cmd->file->private_data; struct ublk_queue *ubq; @@ -3824,7 +3825,8 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data) static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe, + struct ublksrv_io_cmd); struct ublk_device *ub = cmd->file->private_data; unsigned tag = READ_ONCE(ub_cmd->tag); unsigned q_id = READ_ONCE(ub_cmd->q_id); @@ -3853,7 +3855,7 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe); + const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe, struct ublk_batch_io); struct ublk_device *ub = cmd->file->private_data; struct ublk_batch_io_data data = { .ub = ub, @@ -5106,7 +5108,8 @@ static int ublk_char_dev_permission(struct ublk_device *ub, static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, struct io_uring_cmd *cmd, u64 *addr, u16 *len) { - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_ctrl_cmd *header = io_uring_sqe128_cmd(cmd->sqe, + struct ublksrv_ctrl_cmd); bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; void __user *argp = (void __user *)*addr; char *dev_path = NULL; @@ -5199,7 +5202,8 @@ static bool ublk_ctrl_uring_cmd_may_sleep(u32 cmd_op) static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) { - const struct ublksrv_ctrl_cmd *header = io_uring_sqe_cmd(cmd->sqe); + const struct ublksrv_ctrl_cmd *header = io_uring_sqe128_cmd(cmd->sqe, + struct ublksrv_ctrl_cmd); struct ublk_device *ub = NULL; u32 cmd_op = cmd->cmd_op; int ret = -EINVAL; diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index fb62633ccbb0..8844bbd39515 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -447,7 +447,8 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec) { struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); - const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe); + const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe, + struct nvme_uring_cmd); struct request_queue *q = ns ? ns->queue : ctrl->admin_q; struct nvme_uring_data d; struct nvme_command c; diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c index 5ceb217ced1b..60f2058feb74 100644 --- a/fs/fuse/dev_uring.c +++ b/fs/fuse/dev_uring.c @@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent) static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags, struct fuse_conn *fc) { - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); + const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe, + struct fuse_uring_cmd_req); struct fuse_ring_ent *ent; int err; struct fuse_ring *ring = fc->ring; @@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd, static int fuse_uring_register(struct io_uring_cmd *cmd, unsigned int issue_flags, struct fuse_conn *fc) { - const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe); + const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe, + struct fuse_uring_cmd_req); struct fuse_ring *ring = smp_load_acquire(&fc->ring); struct fuse_ring_queue *queue; struct fuse_ring_ent *ent; diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h index 375fd048c4cb..331dcbefe72f 100644 --- a/include/linux/io_uring/cmd.h +++ b/include/linux/io_uring/cmd.h @@ -20,10 +20,17 @@ struct io_uring_cmd { u8 unused[8]; }; -static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe) -{ - return sqe->cmd; -} +#define io_uring_sqe128_cmd(sqe, type) ({ \ + BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) - \ + offsetof(struct io_uring_sqe, cmd))); \ + (const type *)(sqe)->cmd; \ +}) + +#define io_uring_sqe_cmd(sqe, type) ({ \ + BUILD_BUG_ON(sizeof(type) > (sizeof(struct io_uring_sqe) - \ + offsetof(struct io_uring_sqe, cmd))); \ + (const type *)(sqe)->cmd; \ +}) static inline void io_uring_cmd_private_sz_check(size_t cmd_sz) { -- 2.52.0