Re: [PATCH] ublk: reject FETCH from non-userspace context

[Jens Axboe <axboe@kernel.dk>]

On 5/1/26 4:36 AM, Ming Lei wrote:
> On Fri, May 01, 2026 at 04:34:11AM -0600, Jens Axboe wrote:
>> On 5/1/26 2:52 AM, Ming Lei wrote:
>>> __ublk_fetch() sets io->task to current, which is later checked
>>> against io_uring_cmd_get_task() in ublk_uring_cmd_cancel_fn().
>>> With REQ_F_FORCE_ASYNC, the FETCH uring_cmd can be issued from
>>> task work, which can be run from io_uring's fallback workqueue,
>>> causing a task mismatch and triggering the WARN in cancel_fn.
>>>
>>> Reject FETCH if current is not a real userspace task, and it is
>>> reasonable for failing it in case of io_uring fallback.
>>
>> I think this should be caught in ublk_ch_uring_cmd_cb(), which
>> should not hit ublk_ch_uring_cmd_local() if tw.cancel is true.
>> fallback work should just be terminated, not be issued.
> 
> Yeah, that is definitely better, will take it in V2.

Something like this, totally untested. Caveat: probably worth checking
the other tw paths in ublk as well!

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 8e5f3738c203..d10460d29e4a 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -3496,8 +3496,10 @@ static void ublk_ch_uring_cmd_cb(struct io_tw_req tw_req, io_tw_token_t tw)
 {
 	unsigned int issue_flags = IO_URING_CMD_TASK_WORK_ISSUE_FLAGS;
 	struct io_uring_cmd *cmd = io_uring_cmd_from_tw(tw_req);
-	int ret = ublk_ch_uring_cmd_local(cmd, issue_flags);
+	int ret = -ECANCELED;
 
+	if (!tw.cancel)
+		ret = ublk_ch_uring_cmd_local(cmd, issue_flags);
 	if (ret != -EIOCBQUEUED)
 		io_uring_cmd_done(cmd, ret, issue_flags);
 }

-- 
Jens Axboe