linux-kernel - Re: [PATCH v2 0/3] ublk: fix struct ublksrv_ctrl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <176986734625.961362.7129018676090960172.b4-ty@kernel.dk>
Date: Sat, 31 Jan 2026 06:49:06 -0700
From: Jens Axboe <axboe@...nel.dk>
To: Ming Lei <ming.lei@...hat.com>, 
 Caleb Sander Mateos <csander@...estorage.com>
Cc: Govindarajulu Varadarajan <govind.varadar@...il.com>, 
 linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 0/3] ublk: fix struct ublksrv_ctrl_cmd accesses


On Fri, 30 Jan 2026 10:14:11 -0700, Caleb Sander Mateos wrote:
> struct ublksrv_ctrl_cmd is part of the io_uring_sqe. Since commit
> 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK
> issue") allowed some commands to be handled in the non-blocking issue,
> the SQE may lie in userspace-mapped memory. Validate that the SQE size
> is the expected 128 bytes before dereferencing it. Use READ_ONCE() to
> copy the ublksrv_ctrl_cmd from the SQE to a local variable. This avoids
> data races if userspace writes to the SQE concurrently.
> 
> [...]

Applied, thanks!

[1/3] ublk: Validate SQE128 flag before accessing the cmd
      commit: da7e4b75e50c087d2031a92f6646eb90f7045a67
[2/3] ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd
      commit: ed9f54cc1e335096733aed03c2a46de3d58922ed
[3/3] ublk: drop ublk_ctrl_start_recovery() header argument
      commit: 373df2c0255da77f0842368708afce771e1330ca

Best regards,
-- 
Jens Axboe