From: Ming Lei <ming.lei@redhat.com>
To: Caleb Sander Mateos <csander@purestorage.com>
Cc: Jens Axboe <axboe@kernel.dk>,
Govindarajulu Varadarajan <govind.varadar@gmail.com>,
linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/4] ublk: Validate SQE128 flag before accessing the cmd
Date: Fri, 30 Jan 2026 16:03:09 +0800 [thread overview]
Message-ID: <aXxlvbLeqpscOFI9@fedora> (raw)
In-Reply-To: <20260129224618.975401-2-csander@purestorage.com>
On Thu, Jan 29, 2026 at 03:46:14PM -0700, Caleb Sander Mateos wrote:
> From: Govindarajulu Varadarajan <govind.varadar@gmail.com>
>
> ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before
> IO_URING_F_SQE128 flag check. This could cause out of boundary memory
> access.
>
> Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return
> -EINVAL immediately if the flag is not set.
>
> Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
> Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
> Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Thanks,
Ming
next prev parent reply other threads:[~2026-01-30 8:03 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-29 22:46 [PATCH 0/4] ublk: fix struct ublksrv_ctrl_cmd accesses Caleb Sander Mateos
2026-01-29 22:46 ` [PATCH 1/4] ublk: Validate SQE128 flag before accessing the cmd Caleb Sander Mateos
2026-01-30 8:03 ` Ming Lei [this message]
2026-01-29 22:46 ` [PATCH 2/4] ublk: don't write to struct ublksrv_ctrl_cmd Caleb Sander Mateos
2026-01-30 15:48 ` Ming Lei
2026-01-30 16:05 ` Ming Lei
2026-01-29 22:46 ` [PATCH 3/4] ublk: use READ_ONCE() to read " Caleb Sander Mateos
2026-01-30 15:56 ` Ming Lei
2026-01-29 22:46 ` [PATCH 4/4] ublk: drop ublk_ctrl_{start,end}_recovery() header argument Caleb Sander Mateos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXxlvbLeqpscOFI9@fedora \
--to=ming.lei@redhat.com \
--cc=axboe@kernel.dk \
--cc=csander@purestorage.com \
--cc=govind.varadar@gmail.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.