linux-kernel - Re: [PATCH] nvme: map uring_cmd data even if address is 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0a11a42f-3476-46bd-b87a-a72d68344802@kernel.dk>
Date: Thu, 20 Feb 2025 17:55:01 -0700
From: Jens Axboe <axboe@...nel.dk>
To: Xinyu Zhang <xizhang@...estorage.com>, linux-nvme@...ts.infradead.org,
 linux-kernel@...r.kernel.org
Cc: Keith Busch <kbusch@...nel.org>, Christoph Hellwig <hch@....de>,
 Sagi Grimberg <sagi@...mberg.me>,
 Caleb Sander Mateos <csander@...estorage.com>
Subject: Re: [PATCH] nvme: map uring_cmd data even if address is 0

On 2/20/25 4:51 PM, Xinyu Zhang wrote:
> When using kernel registered bvec fixed buffers, the "address" is
> actually the offset into the bvec rather than userspace address.
> Therefore it can be 0.
> We can skip checking whether the address is NULL before mapping
> uring_cmd data. Bad userspace address will be handled properly later when
> the user buffer is imported.
> With this patch, we will be able to use the kernel registered bvec fixed
> buffers in io_uring NVMe passthru with ublk zero-copy support in
> https://lore.kernel.org/io-uring/20250218224229.837848-1-kbusch@meta.com/T/#u.
> 
> Signed-off-by: Xinyu Zhang <xizhang@...estorage.com>
> Reviewed-by: Caleb Sander Mateos <csander@...estorage.com>
> ---
>  drivers/nvme/host/ioctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index 60383da86feda..724ab542b4c33 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -500,7 +500,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
>  		return PTR_ERR(req);
>  	req->timeout = d.timeout_ms ? msecs_to_jiffies(d.timeout_ms) : 0;
>  
> -	if (d.addr && d.data_len) {
> +	if (d.data_len) {
>  		ret = nvme_map_user_request(req, d.addr,
>  			d.data_len, nvme_to_user_ptr(d.metadata),
>  			d.metadata_len, 0, ioucmd, vec);

Looks good to me:

Reviewed-by: Jens Axboe <axboe@...nel.dk>

-- 
Jens Axboe