ublk: Validate SQE128 flag before accessing the cmd
ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before
IO_URING_F_SQE128 flag check. This could cause out of boundary memory
access.
Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return
-EINVAL immediately if the flag is not set.
Fixes: 71f28f3136 ("ublk_drv: add io_uring based userspace block driver")
Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
parent
da562d92e6
commit
da7e4b75e5
|
|
@ -5221,10 +5221,10 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd,
|
|||
issue_flags & IO_URING_F_NONBLOCK)
|
||||
return -EAGAIN;
|
||||
|
||||
ublk_ctrl_cmd_dump(cmd);
|
||||
|
||||
if (!(issue_flags & IO_URING_F_SQE128))
|
||||
goto out;
|
||||
return -EINVAL;
|
||||
|
||||
ublk_ctrl_cmd_dump(cmd);
|
||||
|
||||
ret = ublk_check_cmd_op(cmd_op);
|
||||
if (ret)
|
||||
|
|
|
|||
Loading…
Reference in New Issue