diff options
| author | Caleb Sander Mateos <csander@purestorage.com> | 2026-01-08 02:19:36 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-01-12 09:16:33 -0700 |
| commit | fd5a005fa6a261762292a2d89ef8d0174b66f541 (patch) | |
| tree | e789997d58a95e68500572d56b7e1d9ba685d943 /drivers | |
| parent | ca80afd8708fa22f6d3a1e0306ae12a64e5291b5 (diff) | |
ublk: move offset check out of __ublk_check_and_get_req()
__ublk_check_and_get_req() checks that the passed in offset is within
the data length of the specified ublk request. However, only user copy
(ublk_check_and_get_req()) supports accessing ublk request data at a
nonzero offset. Zero-copy buffer registration (ublk_register_io_buf())
always passes 0 for the offset, so the check is unnecessary. Move the
check from __ublk_check_and_get_req() to ublk_check_and_get_req().
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/block/ublk_drv.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 57a1af3d5261..d428a25121db 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -255,7 +255,7 @@ static void ublk_io_release(void *priv); static void ublk_stop_dev_unlocked(struct ublk_device *ub); static void ublk_abort_queue(struct ublk_device *ub, struct ublk_queue *ubq); static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub, - u16 q_id, u16 tag, struct ublk_io *io, size_t offset); + u16 q_id, u16 tag, struct ublk_io *io); static inline unsigned int ublk_req_build_flags(struct request *req); static inline struct ublksrv_io_desc * @@ -2297,7 +2297,7 @@ static int ublk_register_io_buf(struct io_uring_cmd *cmd, if (!ublk_dev_support_zero_copy(ub)) return -EINVAL; - req = __ublk_check_and_get_req(ub, q_id, tag, io, 0); + req = __ublk_check_and_get_req(ub, q_id, tag, io); if (!req) return -EINVAL; @@ -2591,7 +2591,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, } static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub, - u16 q_id, u16 tag, struct ublk_io *io, size_t offset) + u16 q_id, u16 tag, struct ublk_io *io) { struct request *req; @@ -2612,9 +2612,6 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub, if (!ublk_rq_has_data(req)) goto fail_put; - if (offset > blk_rq_bytes(req)) - goto fail_put; - return req; fail_put: ublk_put_req_ref(io, req); @@ -2696,10 +2693,15 @@ ublk_user_copy(struct kiocb *iocb, struct iov_iter *iter, int dir) return -EINVAL; io = &ubq->ios[tag]; - req = __ublk_check_and_get_req(ub, q_id, tag, io, buf_off); + req = __ublk_check_and_get_req(ub, q_id, tag, io); if (!req) return -EINVAL; + if (buf_off > blk_rq_bytes(req)) { + ret = -EINVAL; + goto out; + } + if (!ublk_check_ubuf_dir(req, dir)) { ret = -EACCES; goto out; |