ublk: add helper ublk_check_fetch_buf()

Add a helper ublk_check_fetch_buf() to validate UBLK_IO_FETCH_REQ's addr.
This doesn't require access to the ublk_io, so it can be done before taking
the ublk_device mutex.

This way also fixes one missing return value of -EINVAL in case of early
failure from ublk_fetch().

Fixes: b69b8edfb27d ("ublk: properly serialize all FETCH_REQs")
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250713143415.2857561-9-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c69d4fafc6ccb418ca876d257cfa78b0d57ae700..1b22fd5f5610df527f84489d5fadc4a55a3b1e85 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2165,6 +2165,22 @@ static int ublk_unregister_io_buf(struct io_uring_cmd *cmd,
        return io_buffer_unregister_bvec(cmd, index, issue_flags);
 }
 
+static int ublk_check_fetch_buf(const struct ublk_queue *ubq, __u64 buf_addr)
+{
+       if (ublk_need_map_io(ubq)) {
+               /*
+                * FETCH_RQ has to provide IO buffer if NEED GET
+                * DATA is not enabled
+                */
+               if (!buf_addr && !ublk_need_get_data(ubq))
+                       return -EINVAL;
+       } else if (buf_addr) {
+               /* User copy requires addr to be unset */
+               return -EINVAL;
+       }
+       return 0;
+}
+
 static int ublk_fetch(struct io_uring_cmd *cmd, struct ublk_queue *ubq,
                      struct ublk_io *io, __u64 buf_addr)
 {
@@ -2191,19 +2207,6 @@ static int ublk_fetch(struct io_uring_cmd *cmd, struct ublk_queue *ubq,
 
        WARN_ON_ONCE(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV);
 
-       if (ublk_need_map_io(ubq)) {
-               /*
-                * FETCH_RQ has to provide IO buffer if NEED GET
-                * DATA is not enabled
-                */
-               if (!buf_addr && !ublk_need_get_data(ubq))
-                       goto out;
-       } else if (buf_addr) {
-               /* User copy requires addr to be unset */
-               ret = -EINVAL;
-               goto out;
-       }
-
        ublk_fill_io_cmd(io, cmd);
        ret = ublk_config_io_buf(ubq, io, cmd, buf_addr, NULL);
        if (ret)
@@ -2316,6 +2319,9 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd,
        io = &ubq->ios[tag];
        /* UBLK_IO_FETCH_REQ can be handled on any task, which sets io->task */
        if (unlikely(_IOC_NR(cmd_op) == UBLK_IO_FETCH_REQ)) {
+               ret = ublk_check_fetch_buf(ubq, ub_cmd->addr);
+               if (ret)
+                       goto out;
                ret = ublk_fetch(cmd, ubq, io, ub_cmd->addr);
                if (ret)
                        goto out;