From c75e599c7f40741471375eca5e5d0babe4f7d9a0 Mon Sep 17 00:00:00 2001 From: Rahul Chandelkar Date: Wed, 27 May 2026 16:29:18 +0530 Subject: [PATCH] scsi: bsg: copy uring_cmd payload to prevent double-fetch from shared SQE scsi_bsg_uring_cmd() and scsi_bsg_map_user_buffer() read bsg_uring_cmd fields directly from the shared mmap'd io_uring submission ring via io_uring_sqe128_cmd(). On the inline execution path, io_uring has not yet copied the SQE to kernel memory, so a concurrent userspace thread can modify fields between reads. cmd->request_len is read for the bounds check, for the cmd_len assignment, and for the copy_from_user length. A racing thread can change request_len between the bounds check (passes with <= 32) and copy_from_user (uses the enlarged value), overflowing the 32-byte scmd->cmnd[] buffer into subsequent struct scsi_cmnd fields. scsi_bsg_map_user_buffer() independently re-derives its cmd pointer from the same shared SQE, re-reading dout_xfer_len, din_xfer_len, dout_xferp, and din_xferp, enabling direction confusion and buffer length races. Copy struct bsg_uring_cmd to a stack-local variable before use in both functions. The pointer variable 'cmd' is redirected to the local copy so the rest of each function is unchanged. Tested with KASAN on QEMU (virtio-scsi, 2 vCPUs). Without this fix, a two-thread race produces: BUG: KASAN: wild-memory-access in scsi_queue_rq+0x4a3/0x58a0 Write of size 96 at addr dead000000001000 by task poc/67 Call Trace: kasan_report+0xce/0x100 __asan_memset+0x23/0x50 scsi_queue_rq+0x4a3/0x58a0 scsi_bsg_uring_cmd+0x942/0x1570 io_uring_cmd+0x2f6/0x950 io_issue_sqe+0xe5/0x22d0 Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Rahul Chandelkar Reviewed-by: Bart Van Assche --- drivers/scsi/scsi_bsg.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c index e80dec53174ea..244740655eb07 100644 --- a/drivers/scsi/scsi_bsg.c +++ b/drivers/scsi/scsi_bsg.c @@ -78,13 +78,21 @@ static int scsi_bsg_map_user_buffer(struct request *req, struct io_uring_cmd *ioucmd, unsigned int issue_flags, gfp_t gfp_mask) { - const struct bsg_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe, struct bsg_uring_cmd); - bool is_write = cmd->dout_xfer_len > 0; - u64 buf_addr = is_write ? cmd->dout_xferp : cmd->din_xferp; - unsigned long buf_len = is_write ? cmd->dout_xfer_len : cmd->din_xfer_len; + struct bsg_uring_cmd local_cmd; + const struct bsg_uring_cmd *cmd; + bool is_write; + u64 buf_addr; + unsigned long buf_len; struct iov_iter iter; int ret; + memcpy(&local_cmd, io_uring_sqe128_cmd(ioucmd->sqe, struct bsg_uring_cmd), + sizeof(local_cmd)); + cmd = &local_cmd; + is_write = cmd->dout_xfer_len > 0; + buf_addr = is_write ? cmd->dout_xferp : cmd->din_xferp; + buf_len = is_write ? cmd->dout_xfer_len : cmd->din_xfer_len; + if (ioucmd->flags & IORING_URING_CMD_FIXED) { ret = io_uring_cmd_import_fixed(buf_addr, buf_len, is_write ? WRITE : READ, @@ -104,13 +112,18 @@ static int scsi_bsg_uring_cmd(struct request_queue *q, struct io_uring_cmd *iouc unsigned int issue_flags, bool open_for_write) { struct scsi_bsg_uring_cmd_pdu *pdu = scsi_bsg_uring_cmd_pdu(ioucmd); - const struct bsg_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe, struct bsg_uring_cmd); + struct bsg_uring_cmd local_cmd; + const struct bsg_uring_cmd *cmd; struct scsi_cmnd *scmd; struct request *req; blk_mq_req_flags_t blk_flags = 0; gfp_t gfp_mask = GFP_KERNEL; int ret; + memcpy(&local_cmd, io_uring_sqe128_cmd(ioucmd->sqe, struct bsg_uring_cmd), + sizeof(local_cmd)); + cmd = &local_cmd; + if (cmd->protocol != BSG_PROTOCOL_SCSI || cmd->subprotocol != BSG_SUB_PROTOCOL_SCSI_CMD) return -EINVAL;