linux-kernel - Re: [RFC PATCH v4 4/5] btrfs: ioctl: introduce btrfs_uring_import

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <566c700c-d3d5-4899-8de1-87092e76310c@gmail.com>
Date: Tue, 18 Mar 2025 07:25:51 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: Sidong Yang <sidong.yang@...iosa.ai>, Jens Axboe <axboe@...nel.dk>
Cc: Josef Bacik <josef@...icpanda.com>, David Sterba <dsterba@...e.com>,
 linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 io-uring@...r.kernel.org
Subject: Re: [RFC PATCH v4 4/5] btrfs: ioctl: introduce
 btrfs_uring_import_iovec()

On 3/18/25 01:58, Sidong Yang wrote:
> On Mon, Mar 17, 2025 at 09:40:05AM -0600, Jens Axboe wrote:
>> On 3/17/25 7:57 AM, Sidong Yang wrote:
>>> This patch introduces btrfs_uring_import_iovec(). In encoded read/write
>>> with uring cmd, it uses import_iovec without supporting fixed buffer.
>>> btrfs_using_import_iovec() could use fixed buffer if cmd flags has
>>> IORING_URING_CMD_FIXED.
>>>
>>> Signed-off-by: Sidong Yang <sidong.yang@...iosa.ai>
>>> ---
>>>   fs/btrfs/ioctl.c | 32 ++++++++++++++++++++++++--------
>>>   1 file changed, 24 insertions(+), 8 deletions(-)
>>>
>>> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
>>> index 6c18bad53cd3..a7b52fd99059 100644
>>> --- a/fs/btrfs/ioctl.c
>>> +++ b/fs/btrfs/ioctl.c
>>> @@ -4802,6 +4802,28 @@ struct btrfs_uring_encoded_data {
>>>   	struct iov_iter iter;
>>>   };
>>>   
>>> +static int btrfs_uring_import_iovec(struct io_uring_cmd *cmd,
>>> +				    unsigned int issue_flags, int rw)
>>> +{
>>> +	struct btrfs_uring_encoded_data *data =
>>> +		io_uring_cmd_get_async_data(cmd)->op_data;
>>> +	int ret;
>>> +
>>> +	if (cmd && (cmd->flags & IORING_URING_CMD_FIXED)) {
>>> +		data->iov = NULL;
>>> +		ret = io_uring_cmd_import_fixed_vec(cmd, data->args.iov,
>>> +						    data->args.iovcnt,
>>> +						    ITER_DEST, issue_flags,
>>> +						    &data->iter);
>>> +	} else {
>>> +		data->iov = data->iovstack;
>>> +		ret = import_iovec(rw, data->args.iov, data->args.iovcnt,
>>> +				   ARRAY_SIZE(data->iovstack), &data->iov,
>>> +				   &data->iter);
>>> +	}
>>> +	return ret;
>>> +}
>>
>> How can 'cmd' be NULL here?
> 
> It seems that there is no checkes for 'cmd' before and it works same as before.
> But I think it's better to add a check in function start for safety.

The check goes two lines after you already dereferenced it, and it
seems to be called from io_uring cmd specific code. The null check
only adds to confusion.

-- 
Pavel Begunkov