Linux block layer
 help / color / mirror / Atom feed
* [PATCH] ublk: santizize the arguments from userspace when adding a device
@ 2025-06-19  2:10 Ronnie Sahlberg
  2025-06-19  2:36 ` Ming Lei
  2025-06-19 13:54 ` Jens Axboe
  0 siblings, 2 replies; 3+ messages in thread
From: Ronnie Sahlberg @ 2025-06-19  2:10 UTC (permalink / raw)
  To: linux-block; +Cc: ming.lei

From: Ronnie Sahlberg <rsahlberg@whamcloud.com>

Sanity check the values for queue depth and number of queues
we get from userspace when adding a device.

Signed-off-by: Ronnie Sahlberg <rsahlberg@whamcloud.com>
---
 drivers/block/ublk_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 374e4efa8759..febdb5609e95 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2336,6 +2336,9 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)
 	if (copy_from_user(&info, argp, sizeof(info)))
 		return -EFAULT;
 
+	if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues > UBLK_MAX_NR_QUEUES)
+		return -EINVAL;
+
 	if (capable(CAP_SYS_ADMIN))
 		info.flags &= ~UBLK_F_UNPRIVILEGED_DEV;
 	else if (!(info.flags & UBLK_F_UNPRIVILEGED_DEV))
-- 
2.43.5


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] ublk: santizize the arguments from userspace when adding a device
  2025-06-19  2:10 [PATCH] ublk: santizize the arguments from userspace when adding a device Ronnie Sahlberg
@ 2025-06-19  2:36 ` Ming Lei
  2025-06-19 13:54 ` Jens Axboe
  1 sibling, 0 replies; 3+ messages in thread
From: Ming Lei @ 2025-06-19  2:36 UTC (permalink / raw)
  To: Ronnie Sahlberg; +Cc: linux-block

On Thu, Jun 19, 2025 at 12:10:31PM +1000, Ronnie Sahlberg wrote:
> From: Ronnie Sahlberg <rsahlberg@whamcloud.com>
> 
> Sanity check the values for queue depth and number of queues
> we get from userspace when adding a device.
> 
> Signed-off-by: Ronnie Sahlberg <rsahlberg@whamcloud.com>
> ---
>  drivers/block/ublk_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 374e4efa8759..febdb5609e95 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2336,6 +2336,9 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)
>  	if (copy_from_user(&info, argp, sizeof(info)))
>  		return -EFAULT;
>  
> +	if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues > UBLK_MAX_NR_QUEUES)
> +		return -EINVAL;
> +
>  	if (capable(CAP_SYS_ADMIN))
>  		info.flags &= ~UBLK_F_UNPRIVILEGED_DEV;
>  	else if (!(info.flags & UBLK_F_UNPRIVILEGED_DEV))

Reviewed-by: Ming Lei <ming.lei@redhat.com>

Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
Fixes: 62fe99cef94a ("ublk: add read()/write() support for ublk char device")


Thanks,
Ming


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] ublk: santizize the arguments from userspace when adding a device
  2025-06-19  2:10 [PATCH] ublk: santizize the arguments from userspace when adding a device Ronnie Sahlberg
  2025-06-19  2:36 ` Ming Lei
@ 2025-06-19 13:54 ` Jens Axboe
  1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2025-06-19 13:54 UTC (permalink / raw)
  To: linux-block, Ronnie Sahlberg; +Cc: ming.lei


On Thu, 19 Jun 2025 12:10:31 +1000, Ronnie Sahlberg wrote:
> Sanity check the values for queue depth and number of queues
> we get from userspace when adding a device.
> 
> 

Applied, thanks!

[1/1] ublk: santizize the arguments from userspace when adding a device
      commit: 8c8472855884355caf3d8e0c50adf825f83454b2

Best regards,
-- 
Jens Axboe




^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2025-06-19 13:54 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-19  2:10 [PATCH] ublk: santizize the arguments from userspace when adding a device Ronnie Sahlberg
2025-06-19  2:36 ` Ming Lei
2025-06-19 13:54 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox