ublk: enhance check for register/unregister io buffer command

The simple check of UBLK_IO_FLAG_OWNED_BY_SRV can avoid incorrect
register/unregister io buffer easily, so check it before calling
starting to register/un-register io buffer.

Also only allow io buffer register/unregister uring_cmd in case of
UBLK_F_SUPPORT_ZERO_COPY.

Also mark argument 'ublk_queue *' of ublk_register_io_buf as const.

Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 1f6540e2aabb ("ublk: zc register/unregister bvec")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250429022941.1718671-4-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 0a3a3c64316d7e32f1a130ab2b19b999194796a0..c624d8f653ae37da706af0e46c5fb59468902cdd 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -201,7 +201,7 @@ struct ublk_params_header {
 static void ublk_stop_dev_unlocked(struct ublk_device *ub);
 static void ublk_abort_queue(struct ublk_device *ub, struct ublk_queue *ubq);
 static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
-               struct ublk_queue *ubq, int tag, size_t offset);
+               const struct ublk_queue *ubq, int tag, size_t offset);
 static inline unsigned int ublk_req_build_flags(struct request *req);
 static inline struct ublksrv_io_desc *ublk_get_iod(struct ublk_queue *ubq,
                                                   int tag);
@@ -1949,13 +1949,20 @@ static void ublk_io_release(void *priv)
 }
 
 static int ublk_register_io_buf(struct io_uring_cmd *cmd,
-                               struct ublk_queue *ubq, unsigned int tag,
+                               const struct ublk_queue *ubq, unsigned int tag,
                                unsigned int index, unsigned int issue_flags)
 {
        struct ublk_device *ub = cmd->file->private_data;
+       const struct ublk_io *io = &ubq->ios[tag];
        struct request *req;
        int ret;
 
+       if (!ublk_support_zero_copy(ubq))
+               return -EINVAL;
+
+       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
+               return -EINVAL;
+
        req = __ublk_check_and_get_req(ub, ubq, tag, 0);
        if (!req)
                return -EINVAL;
@@ -1971,8 +1978,17 @@ static int ublk_register_io_buf(struct io_uring_cmd *cmd,
 }
 
 static int ublk_unregister_io_buf(struct io_uring_cmd *cmd,
+                                 const struct ublk_queue *ubq, unsigned int tag,
                                  unsigned int index, unsigned int issue_flags)
 {
+       const struct ublk_io *io = &ubq->ios[tag];
+
+       if (!ublk_support_zero_copy(ubq))
+               return -EINVAL;
+
+       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
+               return -EINVAL;
+
        return io_buffer_unregister_bvec(cmd, index, issue_flags);
 }
 
@@ -2076,7 +2092,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd,
        case UBLK_IO_REGISTER_IO_BUF:
                return ublk_register_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);
        case UBLK_IO_UNREGISTER_IO_BUF:
-               return ublk_unregister_io_buf(cmd, ub_cmd->addr, issue_flags);
+               return ublk_unregister_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);
        case UBLK_IO_FETCH_REQ:
                ret = ublk_fetch(cmd, ubq, io, ub_cmd->addr);
                if (ret)
@@ -2128,7 +2144,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd,
 }
 
 static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
-               struct ublk_queue *ubq, int tag, size_t offset)
+               const struct ublk_queue *ubq, int tag, size_t offset)
 {
        struct request *req;