Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 7 Jul 2022 15:58:23 +0800
From:   Ming Lei <ming.lei@redhat.com>
To:     Gabriel Krisman Bertazi <krisman@collabora.com>
Cc:     Jens Axboe <axboe@kernel.dk>, linux-block@vger.kernel.org,
        Harris James R <james.r.harris@intel.com>,
        linux-kernel@vger.kernel.org, io-uring@vger.kernel.org,
        ZiyangZhang <ZiyangZhang@linux.alibaba.com>,
        Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>,
        Stefan Hajnoczi <stefanha@redhat.com>
Subject: Re: [PATCH V3 1/1] ublk: add io_uring based userspace block driver
Message-ID: <YsaSHwQDndyhfZaf@T590>
References: <20220628160807.148853-1-ming.lei@redhat.com>
 <20220628160807.148853-2-ming.lei@redhat.com>
 <8735fg4jhb.fsf@collabora.com>
 <YsPw+HS8ssmVw86u@T590>
 <YsaQIGbyRKLAOoqR@T590>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YsaQIGbyRKLAOoqR@T590>
Precedence: bulk

On Thu, Jul 07, 2022 at 03:49:52PM +0800, Ming Lei wrote:
> On Tue, Jul 05, 2022 at 04:06:16PM +0800, Ming Lei wrote:
> > On Mon, Jul 04, 2022 at 06:10:40PM -0400, Gabriel Krisman Bertazi wrote:
> > > Ming Lei <ming.lei@redhat.com> writes:
> 
> ...
> > 
> > > 
> > > 
> > > > +			__func__, cmd->cmd_op, ub_cmd->q_id, tag,
> > > > +			ub_cmd->result);
> > > > +
> > > > +	if (!(issue_flags & IO_URING_F_SQE128))
> > > > +		goto out;
> > > > +
> > > > +	ubq = ublk_get_queue(ub, ub_cmd->q_id);
> > > > +	if (!ubq || ub_cmd->q_id != ubq->q_id)
> > > 
> > > q_id is coming from userspace and is used to access an array inside
> > > ublk_get_queue().  I think you need to ensure qid < ub->dev_info.nr_hw_queues
> > > before calling ublk_get_queue() to protect from a kernel bad memory
> > > access triggered by userspace.
> > 
> > Good catch!
> 
> Turns out the check on 'qid < ub->dev_info.nr_hw_queues' isn't needed,
> since the condition of 'ub_cmd->q_id != ubq->q_id' is more strict.

But ubq is retrieved via ->q_id, so we do need the validation.

Sorry for the noise.

Thanks,
Ming