10
10
11
11
enum {
12
12
NVME_IOCTL_VEC = (1 << 0 ),
13
+ NVME_IOCTL_PARTITION = (1 << 1 ),
13
14
};
14
15
15
16
static bool nvme_cmd_allowed (struct nvme_ns * ns , struct nvme_command * c ,
16
- fmode_t mode )
17
+ unsigned int flags , fmode_t mode )
17
18
{
18
19
u32 effects ;
19
20
20
21
if (capable (CAP_SYS_ADMIN ))
21
22
return true;
22
23
24
+ /*
25
+ * Do not allow unprivileged passthrough on partitions, as that allows an
26
+ * escape from the containment of the partition.
27
+ */
28
+ if (flags & NVME_IOCTL_PARTITION )
29
+ return false;
30
+
23
31
/*
24
32
* Do not allow unprivileged processes to send vendor specific or fabrics
25
33
* commands as we can't be sure about their effects.
@@ -327,7 +335,8 @@ static bool nvme_validate_passthru_nsid(struct nvme_ctrl *ctrl,
327
335
}
328
336
329
337
static int nvme_user_cmd (struct nvme_ctrl * ctrl , struct nvme_ns * ns ,
330
- struct nvme_passthru_cmd __user * ucmd , fmode_t mode )
338
+ struct nvme_passthru_cmd __user * ucmd , unsigned int flags ,
339
+ fmode_t mode )
331
340
{
332
341
struct nvme_passthru_cmd cmd ;
333
342
struct nvme_command c ;
@@ -355,7 +364,7 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
355
364
c .common .cdw14 = cpu_to_le32 (cmd .cdw14 );
356
365
c .common .cdw15 = cpu_to_le32 (cmd .cdw15 );
357
366
358
- if (!nvme_cmd_allowed (ns , & c , mode ))
367
+ if (!nvme_cmd_allowed (ns , & c , 0 , mode ))
359
368
return - EACCES ;
360
369
361
370
if (cmd .timeout_ms )
@@ -402,7 +411,7 @@ static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
402
411
c .common .cdw14 = cpu_to_le32 (cmd .cdw14 );
403
412
c .common .cdw15 = cpu_to_le32 (cmd .cdw15 );
404
413
405
- if (!nvme_cmd_allowed (ns , & c , mode ))
414
+ if (!nvme_cmd_allowed (ns , & c , flags , mode ))
406
415
return - EACCES ;
407
416
408
417
if (cmd .timeout_ms )
@@ -571,7 +580,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
571
580
c .common .cdw14 = cpu_to_le32 (READ_ONCE (cmd -> cdw14 ));
572
581
c .common .cdw15 = cpu_to_le32 (READ_ONCE (cmd -> cdw15 ));
573
582
574
- if (!nvme_cmd_allowed (ns , & c , ioucmd -> file -> f_mode ))
583
+ if (!nvme_cmd_allowed (ns , & c , 0 , ioucmd -> file -> f_mode ))
575
584
return - EACCES ;
576
585
577
586
d .metadata = READ_ONCE (cmd -> metadata );
@@ -641,7 +650,7 @@ static int nvme_ctrl_ioctl(struct nvme_ctrl *ctrl, unsigned int cmd,
641
650
{
642
651
switch (cmd ) {
643
652
case NVME_IOCTL_ADMIN_CMD :
644
- return nvme_user_cmd (ctrl , NULL , argp , mode );
653
+ return nvme_user_cmd (ctrl , NULL , argp , 0 , mode );
645
654
case NVME_IOCTL_ADMIN64_CMD :
646
655
return nvme_user_cmd64 (ctrl , NULL , argp , 0 , mode );
647
656
default :
@@ -668,16 +677,14 @@ struct nvme_user_io32 {
668
677
#endif /* COMPAT_FOR_U64_ALIGNMENT */
669
678
670
679
static int nvme_ns_ioctl (struct nvme_ns * ns , unsigned int cmd ,
671
- void __user * argp , fmode_t mode )
680
+ void __user * argp , unsigned int flags , fmode_t mode )
672
681
{
673
- unsigned int flags = 0 ;
674
-
675
682
switch (cmd ) {
676
683
case NVME_IOCTL_ID :
677
684
force_successful_syscall_return ();
678
685
return ns -> head -> ns_id ;
679
686
case NVME_IOCTL_IO_CMD :
680
- return nvme_user_cmd (ns -> ctrl , ns , argp , mode );
687
+ return nvme_user_cmd (ns -> ctrl , ns , argp , flags , mode );
681
688
/*
682
689
* struct nvme_user_io can have different padding on some 32-bit ABIs.
683
690
* Just accept the compat version as all fields that are used are the
@@ -703,10 +710,14 @@ int nvme_ioctl(struct block_device *bdev, fmode_t mode,
703
710
{
704
711
struct nvme_ns * ns = bdev -> bd_disk -> private_data ;
705
712
void __user * argp = (void __user * )arg ;
713
+ unsigned int flags = 0 ;
714
+
715
+ if (bdev_is_partition (bdev ))
716
+ flags |= NVME_IOCTL_PARTITION ;
706
717
707
718
if (is_ctrl_ioctl (cmd ))
708
719
return nvme_ctrl_ioctl (ns -> ctrl , cmd , argp , mode );
709
- return nvme_ns_ioctl (ns , cmd , argp , mode );
720
+ return nvme_ns_ioctl (ns , cmd , argp , flags , mode );
710
721
}
711
722
712
723
long nvme_ns_chr_ioctl (struct file * file , unsigned int cmd , unsigned long arg )
@@ -717,7 +728,7 @@ long nvme_ns_chr_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
717
728
718
729
if (is_ctrl_ioctl (cmd ))
719
730
return nvme_ctrl_ioctl (ns -> ctrl , cmd , argp , file -> f_mode );
720
- return nvme_ns_ioctl (ns , cmd , argp , file -> f_mode );
731
+ return nvme_ns_ioctl (ns , cmd , argp , 0 , file -> f_mode );
721
732
}
722
733
723
734
static int nvme_uring_cmd_checks (unsigned int issue_flags )
@@ -807,6 +818,10 @@ int nvme_ns_head_ioctl(struct block_device *bdev, fmode_t mode,
807
818
void __user * argp = (void __user * )arg ;
808
819
struct nvme_ns * ns ;
809
820
int srcu_idx , ret = - EWOULDBLOCK ;
821
+ unsigned int flags = 0 ;
822
+
823
+ if (bdev_is_partition (bdev ))
824
+ flags |= NVME_IOCTL_PARTITION ;
810
825
811
826
srcu_idx = srcu_read_lock (& head -> srcu );
812
827
ns = nvme_find_path (head );
@@ -822,7 +837,7 @@ int nvme_ns_head_ioctl(struct block_device *bdev, fmode_t mode,
822
837
return nvme_ns_head_ctrl_ioctl (ns , cmd , argp , head , srcu_idx ,
823
838
mode );
824
839
825
- ret = nvme_ns_ioctl (ns , cmd , argp , mode );
840
+ ret = nvme_ns_ioctl (ns , cmd , argp , flags , mode );
826
841
out_unlock :
827
842
srcu_read_unlock (& head -> srcu , srcu_idx );
828
843
return ret ;
@@ -847,7 +862,7 @@ long nvme_ns_head_chr_ioctl(struct file *file, unsigned int cmd,
847
862
return nvme_ns_head_ctrl_ioctl (ns , cmd , argp , head , srcu_idx ,
848
863
file -> f_mode );
849
864
850
- ret = nvme_ns_ioctl (ns , cmd , argp , file -> f_mode );
865
+ ret = nvme_ns_ioctl (ns , cmd , argp , 0 , file -> f_mode );
851
866
out_unlock :
852
867
srcu_read_unlock (& head -> srcu , srcu_idx );
853
868
return ret ;
@@ -946,7 +961,7 @@ static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp,
946
961
kref_get (& ns -> kref );
947
962
up_read (& ctrl -> namespaces_rwsem );
948
963
949
- ret = nvme_user_cmd (ctrl , ns , argp , mode );
964
+ ret = nvme_user_cmd (ctrl , ns , argp , 0 , mode );
950
965
nvme_put_ns (ns );
951
966
return ret ;
952
967
@@ -963,7 +978,7 @@ long nvme_dev_ioctl(struct file *file, unsigned int cmd,
963
978
964
979
switch (cmd ) {
965
980
case NVME_IOCTL_ADMIN_CMD :
966
- return nvme_user_cmd (ctrl , NULL , argp , file -> f_mode );
981
+ return nvme_user_cmd (ctrl , NULL , argp , 0 , file -> f_mode );
967
982
case NVME_IOCTL_ADMIN64_CMD :
968
983
return nvme_user_cmd64 (ctrl , NULL , argp , 0 , file -> f_mode );
969
984
case NVME_IOCTL_IO_CMD :
0 commit comments