Re: [PATCH] ublk: reject FETCH from non-userspace context

[Ming Lei <tom.leiming@gmail.com>]

On Fri, May 01, 2026 at 04:38:22AM -0600, Jens Axboe wrote:
> On 5/1/26 4:36 AM, Ming Lei wrote:
> > On Fri, May 01, 2026 at 04:34:11AM -0600, Jens Axboe wrote:
> >> On 5/1/26 2:52 AM, Ming Lei wrote:
> >>> __ublk_fetch() sets io->task to current, which is later checked
> >>> against io_uring_cmd_get_task() in ublk_uring_cmd_cancel_fn().
> >>> With REQ_F_FORCE_ASYNC, the FETCH uring_cmd can be issued from
> >>> task work, which can be run from io_uring's fallback workqueue,
> >>> causing a task mismatch and triggering the WARN in cancel_fn.
> >>>
> >>> Reject FETCH if current is not a real userspace task, and it is
> >>> reasonable for failing it in case of io_uring fallback.
> >>
> >> I think this should be caught in ublk_ch_uring_cmd_cb(), which
> >> should not hit ublk_ch_uring_cmd_local() if tw.cancel is true.
> >> fallback work should just be terminated, not be issued.
> > 
> > Yeah, that is definitely better, will take it in V2.
> 
> Something like this, totally untested. Caveat: probably worth checking
> the other tw paths in ublk as well!

tw.cancel can replace the check in ublk_dispatch_req() for ublk_cmd_tw_cb() and
ublk_cmd_list_tw_cb(), which is one cleanup.

ublk_batch_tw_cb() doesn't track io task, so it is just fine.

> 
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 8e5f3738c203..d10460d29e4a 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -3496,8 +3496,10 @@ static void ublk_ch_uring_cmd_cb(struct io_tw_req tw_req, io_tw_token_t tw)
>  {
>  	unsigned int issue_flags = IO_URING_CMD_TASK_WORK_ISSUE_FLAGS;
>  	struct io_uring_cmd *cmd = io_uring_cmd_from_tw(tw_req);
> -	int ret = ublk_ch_uring_cmd_local(cmd, issue_flags);
> +	int ret = -ECANCELED;
>  
> +	if (!tw.cancel)
> +		ret = ublk_ch_uring_cmd_local(cmd, issue_flags);
>  	if (ret != -EIOCBQUEUED)
>  		io_uring_cmd_done(cmd, ret, issue_flags);
>  }

This fix looks good.


Thanks,
Ming