io_uring: Add size check for sqe->cmd

For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
check if size of user struct does not exceed 80 bytes at compile time.
User doesn't have to track this manually during development.

Replace io_uring_sqe_cmd() inline func with macro and add
io_uring_sqe128_cmd() which checks struct
size for 16 bytes cmd and 80 bytes cmd respectively.

Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c13cda5..46a785c 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -3255,7 +3255,8 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
                unsigned int issue_flags)
 {
        /* May point to userspace-mapped memory */
-       const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
+       const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe,
+                                                              struct ublksrv_io_cmd);
        u16 buf_idx = UBLK_INVALID_BUF_IDX;
        struct ublk_device *ub = cmd->file->private_data;
        struct ublk_queue *ubq;
@@ -3833,7 +3834,8 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data)
 static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
                                     unsigned int issue_flags)
 {
-       const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe);
+       const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe,
+                                                              struct ublksrv_io_cmd);
        struct ublk_device *ub = cmd->file->private_data;
        unsigned tag = READ_ONCE(ub_cmd->tag);
        unsigned q_id = READ_ONCE(ub_cmd->q_id);
@@ -3862,7 +3864,8 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,
 static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd,
                                       unsigned int issue_flags)
 {
-       const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe);
+       const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe,
+                                                         struct ublk_batch_io);
        struct ublk_device *ub = cmd->file->private_data;
        struct ublk_batch_io_data data = {
                .ub  = ub,
@@ -5253,7 +5256,8 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
                unsigned int issue_flags)
 {
        /* May point to userspace-mapped memory */
-       const struct ublksrv_ctrl_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);
+       const struct ublksrv_ctrl_cmd *ub_src = io_uring_sqe128_cmd(cmd->sqe,
+                                                                   struct ublksrv_ctrl_cmd);
        struct ublksrv_ctrl_cmd header;
        struct ublk_device *ub = NULL;
        u32 cmd_op = cmd->cmd_op;

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index fb62633..8844bbd 100644 (file)
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -447,7 +447,8 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
                struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec)
 {
        struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
-       const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe);
+       const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe,
+                                                              struct nvme_uring_cmd);
        struct request_queue *q = ns ? ns->queue : ctrl->admin_q;
        struct nvme_uring_data d;
        struct nvme_command c;

diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
index 5ceb217..60f2058 100644 (file)
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent)
 static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,
                                   struct fuse_conn *fc)
 {
-       const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
+       const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,
+                                                                      struct fuse_uring_cmd_req);
        struct fuse_ring_ent *ent;
        int err;
        struct fuse_ring *ring = fc->ring;
@@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
 static int fuse_uring_register(struct io_uring_cmd *cmd,
                               unsigned int issue_flags, struct fuse_conn *fc)
 {
-       const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);
+       const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,
+                                                                      struct fuse_uring_cmd_req);
        struct fuse_ring *ring = smp_load_acquire(&fc->ring);
        struct fuse_ring_queue *queue;
        struct fuse_ring_ent *ent;

diff --git a/include/linux/io_uring/cmd.h b/include/linux/io_uring/cmd.h
index 375fd04..331dcbe 100644 (file)
--- a/include/linux/io_uring/cmd.h
+++ b/include/linux/io_uring/cmd.h
@@ -20,10 +20,17 @@ struct io_uring_cmd {
        u8              unused[8];
 };
 
-static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)
-{
-       return sqe->cmd;
-}
+#define io_uring_sqe128_cmd(sqe, type) ({                                      \
+       BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) -        \
+                                    offsetof(struct io_uring_sqe, cmd)));      \
+       (const type *)(sqe)->cmd;                                               \
+})
+
+#define io_uring_sqe_cmd(sqe, type)    ({                                      \
+       BUILD_BUG_ON(sizeof(type) > (sizeof(struct io_uring_sqe) -              \
+                                    offsetof(struct io_uring_sqe, cmd)));      \
+       (const type *)(sqe)->cmd;                                               \
+})
 
 static inline void io_uring_cmd_private_sz_check(size_t cmd_sz)
 {