[PATCH v2 0/3] ublk: fix struct ublksrv_ctrl_cmd accesses

[Caleb Sander Mateos <csander@purestorage.com>]

struct ublksrv_ctrl_cmd is part of the io_uring_sqe. Since commit
87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK
issue") allowed some commands to be handled in the non-blocking issue,
the SQE may lie in userspace-mapped memory. Validate that the SQE size
is the expected 128 bytes before dereferencing it. Use READ_ONCE() to
copy the ublksrv_ctrl_cmd from the SQE to a local variable. This avoids
data races if userspace writes to the SQE concurrently.

v2:
- Make a local copy of the struct ublksrv_ctrl_cmd (Ming)
- Add Reviewed-by tag (Ming)

Caleb Sander Mateos (2):
  ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd
  ublk: drop ublk_ctrl_start_recovery() header argument

Govindarajulu Varadarajan (1):
  ublk: Validate SQE128 flag before accessing the cmd

 drivers/block/ublk_drv.c | 65 +++++++++++++++++++++-------------------
 1 file changed, 35 insertions(+), 30 deletions(-)

-- 
2.45.2