Skip to content

Commit f2ccb5a

Browse files
metze-sambaaxboe
metze-samba
authored and
axboe
committed
io_uring: make io_kiocb_to_cmd() typesafe
We need to make sure (at build time) that struct io_cmd_data is not casted to a structure that's larger. Signed-off-by: Stefan Metzmacher <metze@samba.org> Link: https://lore.kernel.org/r/c024cdf25ae19fc0319d4180e2298bade8ed17b8.1660201408.git.metze@samba.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent addebd9 commit f2ccb5a

File tree

20 files changed

+134
-129
lines changed

20 files changed

+134
-129
lines changed

‎include/linux/io_uring_types.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -491,7 +491,14 @@ struct io_cmd_data {
491491
__u8 data[56];
492492
};
493493

494-
#define io_kiocb_to_cmd(req) ((void *) &(req)->cmd)
494+
static inline void io_kiocb_cmd_sz_check(size_t cmd_sz)
495+
{
496+
BUILD_BUG_ON(cmd_sz > sizeof(struct io_cmd_data));
497+
}
498+
#define io_kiocb_to_cmd(req, cmd_type) ( \
499+
io_kiocb_cmd_sz_check(sizeof(cmd_type)) , \
500+
((cmd_type *)&(req)->cmd) \
501+
)
495502
#define cmd_to_io_kiocb(ptr) ((struct io_kiocb *) ptr)
496503

497504
struct io_kiocb {

‎io_uring/advise.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ struct io_madvise {
3131
int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
3232
{
3333
#if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
34-
struct io_madvise *ma = io_kiocb_to_cmd(req);
34+
struct io_madvise *ma = io_kiocb_to_cmd(req, struct io_madvise);
3535

3636
if (sqe->buf_index || sqe->off || sqe->splice_fd_in)
3737
return -EINVAL;
@@ -48,7 +48,7 @@ int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
4848
int io_madvise(struct io_kiocb *req, unsigned int issue_flags)
4949
{
5050
#if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
51-
struct io_madvise *ma = io_kiocb_to_cmd(req);
51+
struct io_madvise *ma = io_kiocb_to_cmd(req, struct io_madvise);
5252
int ret;
5353

5454
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -64,7 +64,7 @@ int io_madvise(struct io_kiocb *req, unsigned int issue_flags)
6464

6565
int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
6666
{
67-
struct io_fadvise *fa = io_kiocb_to_cmd(req);
67+
struct io_fadvise *fa = io_kiocb_to_cmd(req, struct io_fadvise);
6868

6969
if (sqe->buf_index || sqe->addr || sqe->splice_fd_in)
7070
return -EINVAL;
@@ -77,7 +77,7 @@ int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
7777

7878
int io_fadvise(struct io_kiocb *req, unsigned int issue_flags)
7979
{
80-
struct io_fadvise *fa = io_kiocb_to_cmd(req);
80+
struct io_fadvise *fa = io_kiocb_to_cmd(req, struct io_fadvise);
8181
int ret;
8282

8383
if (issue_flags & IO_URING_F_NONBLOCK) {

‎io_uring/cancel.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ int io_try_cancel(struct io_uring_task *tctx, struct io_cancel_data *cd,
107107

108108
int io_async_cancel_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
109109
{
110-
struct io_cancel *cancel = io_kiocb_to_cmd(req);
110+
struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
111111

112112
if (unlikely(req->flags & REQ_F_BUFFER_SELECT))
113113
return -EINVAL;
@@ -164,7 +164,7 @@ static int __io_async_cancel(struct io_cancel_data *cd,
164164

165165
int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
166166
{
167-
struct io_cancel *cancel = io_kiocb_to_cmd(req);
167+
struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
168168
struct io_cancel_data cd = {
169169
.ctx = req->ctx,
170170
.data = cancel->addr,

‎io_uring/epoll.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ struct io_epoll {
2323

2424
int io_epoll_ctl_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
2525
{
26-
struct io_epoll *epoll = io_kiocb_to_cmd(req);
26+
struct io_epoll *epoll = io_kiocb_to_cmd(req, struct io_epoll);
2727

2828
pr_warn_once("%s: epoll_ctl support in io_uring is deprecated and will "
2929
"be removed in a future Linux kernel version.\n",
@@ -49,7 +49,7 @@ int io_epoll_ctl_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
4949

5050
int io_epoll_ctl(struct io_kiocb *req, unsigned int issue_flags)
5151
{
52-
struct io_epoll *ie = io_kiocb_to_cmd(req);
52+
struct io_epoll *ie = io_kiocb_to_cmd(req, struct io_epoll);
5353
int ret;
5454
bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
5555

‎io_uring/fs.c‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ struct io_link {
4949

5050
int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
5151
{
52-
struct io_rename *ren = io_kiocb_to_cmd(req);
52+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
5353
const char __user *oldf, *newf;
5454

5555
if (sqe->buf_index || sqe->splice_fd_in)
@@ -79,7 +79,7 @@ int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
7979

8080
int io_renameat(struct io_kiocb *req, unsigned int issue_flags)
8181
{
82-
struct io_rename *ren = io_kiocb_to_cmd(req);
82+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
8383
int ret;
8484

8585
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -95,15 +95,15 @@ int io_renameat(struct io_kiocb *req, unsigned int issue_flags)
9595

9696
void io_renameat_cleanup(struct io_kiocb *req)
9797
{
98-
struct io_rename *ren = io_kiocb_to_cmd(req);
98+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
9999

100100
putname(ren->oldpath);
101101
putname(ren->newpath);
102102
}
103103

104104
int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
105105
{
106-
struct io_unlink *un = io_kiocb_to_cmd(req);
106+
struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink);
107107
const char __user *fname;
108108

109109
if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in)
@@ -128,7 +128,7 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
128128

129129
int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags)
130130
{
131-
struct io_unlink *un = io_kiocb_to_cmd(req);
131+
struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink);
132132
int ret;
133133

134134
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -146,14 +146,14 @@ int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags)
146146

147147
void io_unlinkat_cleanup(struct io_kiocb *req)
148148
{
149-
struct io_unlink *ul = io_kiocb_to_cmd(req);
149+
struct io_unlink *ul = io_kiocb_to_cmd(req, struct io_unlink);
150150

151151
putname(ul->filename);
152152
}
153153

154154
int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
155155
{
156-
struct io_mkdir *mkd = io_kiocb_to_cmd(req);
156+
struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir);
157157
const char __user *fname;
158158

159159
if (sqe->off || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -175,7 +175,7 @@ int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
175175

176176
int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags)
177177
{
178-
struct io_mkdir *mkd = io_kiocb_to_cmd(req);
178+
struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir);
179179
int ret;
180180

181181
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -190,14 +190,14 @@ int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags)
190190

191191
void io_mkdirat_cleanup(struct io_kiocb *req)
192192
{
193-
struct io_mkdir *md = io_kiocb_to_cmd(req);
193+
struct io_mkdir *md = io_kiocb_to_cmd(req, struct io_mkdir);
194194

195195
putname(md->filename);
196196
}
197197

198198
int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
199199
{
200-
struct io_link *sl = io_kiocb_to_cmd(req);
200+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
201201
const char __user *oldpath, *newpath;
202202

203203
if (sqe->len || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -225,7 +225,7 @@ int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
225225

226226
int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags)
227227
{
228-
struct io_link *sl = io_kiocb_to_cmd(req);
228+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
229229
int ret;
230230

231231
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -240,7 +240,7 @@ int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags)
240240

241241
int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
242242
{
243-
struct io_link *lnk = io_kiocb_to_cmd(req);
243+
struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link);
244244
const char __user *oldf, *newf;
245245

246246
if (sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -270,7 +270,7 @@ int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
270270

271271
int io_linkat(struct io_kiocb *req, unsigned int issue_flags)
272272
{
273-
struct io_link *lnk = io_kiocb_to_cmd(req);
273+
struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link);
274274
int ret;
275275

276276
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -286,7 +286,7 @@ int io_linkat(struct io_kiocb *req, unsigned int issue_flags)
286286

287287
void io_link_cleanup(struct io_kiocb *req)
288288
{
289-
struct io_link *sl = io_kiocb_to_cmd(req);
289+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
290290

291291
putname(sl->oldpath);
292292
putname(sl->newpath);

‎io_uring/kbuf.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ void io_destroy_buffers(struct io_ring_ctx *ctx)
272272

273273
int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
274274
{
275-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
275+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
276276
u64 tmp;
277277

278278
if (sqe->rw_flags || sqe->addr || sqe->len || sqe->off ||
@@ -291,7 +291,7 @@ int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
291291

292292
int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
293293
{
294-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
294+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
295295
struct io_ring_ctx *ctx = req->ctx;
296296
struct io_buffer_list *bl;
297297
int ret = 0;
@@ -319,7 +319,7 @@ int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
319319
int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
320320
{
321321
unsigned long size, tmp_check;
322-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
322+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
323323
u64 tmp;
324324

325325
if (sqe->rw_flags || sqe->splice_fd_in)
@@ -421,7 +421,7 @@ static int io_add_buffers(struct io_ring_ctx *ctx, struct io_provide_buf *pbuf,
421421

422422
int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags)
423423
{
424-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
424+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
425425
struct io_ring_ctx *ctx = req->ctx;
426426
struct io_buffer_list *bl;
427427
int ret = 0;

‎io_uring/msg_ring.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ struct io_msg {
2626
static int io_msg_ring_data(struct io_kiocb *req)
2727
{
2828
struct io_ring_ctx *target_ctx = req->file->private_data;
29-
struct io_msg *msg = io_kiocb_to_cmd(req);
29+
struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
3030

3131
if (msg->src_fd || msg->dst_fd || msg->flags)
3232
return -EINVAL;
@@ -76,7 +76,7 @@ static int io_double_lock_ctx(struct io_ring_ctx *ctx,
7676
static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
7777
{
7878
struct io_ring_ctx *target_ctx = req->file->private_data;
79-
struct io_msg *msg = io_kiocb_to_cmd(req);
79+
struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
8080
struct io_ring_ctx *ctx = req->ctx;
8181
unsigned long file_ptr;
8282
struct file *src_file;
@@ -122,7 +122,7 @@ static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
122122

123123
int io_msg_ring_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
124124
{
125-
struct io_msg *msg = io_kiocb_to_cmd(req);
125+
struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
126126

127127
if (unlikely(sqe->buf_index || sqe->personality))
128128
return -EINVAL;
@@ -141,7 +141,7 @@ int io_msg_ring_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
141141

142142
int io_msg_ring(struct io_kiocb *req, unsigned int issue_flags)
143143
{
144-
struct io_msg *msg = io_kiocb_to_cmd(req);
144+
struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
145145
int ret;
146146

147147
ret = -EBADFD;

0 commit comments

Comments
 (0)