ublk: check recovery flags for validity

Setting UBLK_F_USER_RECOVERY_REISSUE without also setting
UBLK_F_USER_RECOVERY is currently silently equivalent to not setting any
recovery flags at all, even though that's obviously not intended. Check
for this case and fail add_dev (with a paranoid warning to aid debugging
any program which might rely on the old behavior) with EINVAL if it is
detected.

Signed-off-by: Uday Shankar <ushankar@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20241007182419.3263186-2-ushankar@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 6ba2c1dd1d878a6a797b41f270a913ae84e5071e..2fc47aea54d18f2e5e2962fd0594412ec0cf9384 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -62,6 +62,9 @@
                | UBLK_F_USER_COPY \
                | UBLK_F_ZONED)
 
+#define UBLK_F_ALL_RECOVERY_FLAGS (UBLK_F_USER_RECOVERY \
+               | UBLK_F_USER_RECOVERY_REISSUE)
+
 /* All UBLK_PARAM_TYPE_* should be included here */
 #define UBLK_PARAM_TYPE_ALL                                \
        (UBLK_PARAM_TYPE_BASIC | UBLK_PARAM_TYPE_DISCARD | \
@@ -2372,6 +2375,14 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)
        else if (!(info.flags & UBLK_F_UNPRIVILEGED_DEV))
                return -EPERM;
 
+       /* forbid nonsense combinations of recovery flags */
+       if ((info.flags & UBLK_F_USER_RECOVERY_REISSUE) &&
+           !(info.flags & UBLK_F_USER_RECOVERY)) {
+               pr_warn("%s: invalid recovery flags %llx\n", __func__,
+                       info.flags & UBLK_F_ALL_RECOVERY_FLAGS);
+               return -EINVAL;
+       }
+
        /*
         * unprivileged device can't be trusted, but RECOVERY and
         * RECOVERY_REISSUE still may hang error handling, so can't