[PATCH] nvme: don't allow unprivileged Write Zeroes passthrough on read-only FDs

[Chaitanya Kulkarni]

On 11/29/22 01:00, Christoph Hellwig wrote:
> Unfortunately Write Zeroes is coded as a no data transfer opcode in NVMe,
> so don't allow it on a read-only FD for unprivileged users.
> 
> Fixes: 855b7717f44b ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands")
> Signed-off-by: Christoph Hellwig <hch at lst.de>
> ---
>   drivers/nvme/host/ioctl.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index 9550a69029b368..8aefe9c904dc9a 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -45,7 +45,7 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c,
>   	 * special file is open for writing, but always allow I/O commands that
>   	 * transfer data from the controller.
>   	 */
> -	if (nvme_is_write(c))
> +	if (nvme_is_write(c) || c->common.opcode == nvme_cmd_write_zeroes)
>   		return mode & FMODE_WRITE;
>   	return true;
>   }

Looks good.

Reviewed-by: Chaitanya Kulkarni <kch at nvidia.com>

-ck