io_uring/cmd: warn on reg buf imports by ineligible cmds

For IORING_URING_CMD_FIXED-less commands io_uring doesn't pull buf_index
from the sqe, so imports might succeed if the index coincide, e.g. when
it's 0, but otherwise it's error prone. Warn if someone tries to import
without the flag.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Link: https://lore.kernel.org/r/a1c2c88e53c3fe96978f23d50c6bc66c2c79c337.1747991070.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index fe84c934734e12a79b7615f5ba59485eb1dfe610..929cad6ee32628aaf04184a628ef4f88fe40217f 100644 (file)
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -275,6 +275,9 @@ int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw,
 {
        struct io_kiocb *req = cmd_to_io_kiocb(ioucmd);
 
+       if (WARN_ON_ONCE(!(ioucmd->flags & IORING_URING_CMD_FIXED)))
+               return -EINVAL;
+
        return io_import_reg_buf(req, iter, ubuf, len, rw, issue_flags);
 }
 EXPORT_SYMBOL_GPL(io_uring_cmd_import_fixed);
@@ -289,6 +292,9 @@ int io_uring_cmd_import_fixed_vec(struct io_uring_cmd *ioucmd,
        struct io_async_cmd *ac = req->async_data;
        int ret;
 
+       if (WARN_ON_ONCE(!(ioucmd->flags & IORING_URING_CMD_FIXED)))
+               return -EINVAL;
+
        ret = io_prep_reg_iovec(req, &ac->vec, uvec, uvec_segs);
        if (ret)
                return ret;