ublk: move offset check out of __ublk_check_and_get_req()

__ublk_check_and_get_req() checks that the passed in offset is within
the data length of the specified ublk request. However, only user copy
(ublk_check_and_get_req()) supports accessing ublk request data at a
nonzero offset. Zero-copy buffer registration (ublk_register_io_buf())
always passes 0 for the offset, so the check is unnecessary. Move the
check from __ublk_check_and_get_req() to ublk_check_and_get_req().

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 57a1af3d52615d1524683603f6bee186f315cf12..d428a25121db7d2d04b813fc94672ebc0aec31e8 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -255,7 +255,7 @@ static void ublk_io_release(void *priv);
 static void ublk_stop_dev_unlocked(struct ublk_device *ub);
 static void ublk_abort_queue(struct ublk_device *ub, struct ublk_queue *ubq);
 static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
-               u16 q_id, u16 tag, struct ublk_io *io, size_t offset);
+               u16 q_id, u16 tag, struct ublk_io *io);
 static inline unsigned int ublk_req_build_flags(struct request *req);
 
 static inline struct ublksrv_io_desc *
@@ -2297,7 +2297,7 @@ static int ublk_register_io_buf(struct io_uring_cmd *cmd,
        if (!ublk_dev_support_zero_copy(ub))
                return -EINVAL;
 
-       req = __ublk_check_and_get_req(ub, q_id, tag, io, 0);
+       req = __ublk_check_and_get_req(ub, q_id, tag, io);
        if (!req)
                return -EINVAL;
 
@@ -2591,7 +2591,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
 }
 
 static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
-               u16 q_id, u16 tag, struct ublk_io *io, size_t offset)
+               u16 q_id, u16 tag, struct ublk_io *io)
 {
        struct request *req;
 
@@ -2612,9 +2612,6 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
        if (!ublk_rq_has_data(req))
                goto fail_put;
 
-       if (offset > blk_rq_bytes(req))
-               goto fail_put;
-
        return req;
 fail_put:
        ublk_put_req_ref(io, req);
@@ -2696,10 +2693,15 @@ ublk_user_copy(struct kiocb *iocb, struct iov_iter *iter, int dir)
                return -EINVAL;
 
        io = &ubq->ios[tag];
-       req = __ublk_check_and_get_req(ub, q_id, tag, io, buf_off);
+       req = __ublk_check_and_get_req(ub, q_id, tag, io);
        if (!req)
                return -EINVAL;
 
+       if (buf_off > blk_rq_bytes(req)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        if (!ublk_check_ubuf_dir(req, dir)) {
                ret = -EACCES;
                goto out;