From: Yang Xiuwei <yangxiuwei@kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b53d495c7f0db46b6748b5ade48371a10dd5d3bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19562 CVE: CVE-2026-90227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Signed-off-by: Keith Busch <kbusch@kernel.org> Conflicts: drivers/nvme/host/core.c [5.10 has no drivers/nvme/host/ioctl.c and no nvme_cmd_allowed() (both introduced by the 6.x nvme ioctl split), so nvme_submit_io() still lives in core.c without the fine-grained permission framework; add the equivalent capable(CAP_SYS_ADMIN) check used by the other passthrough ioctls in this file.] Co-authored-by: BackportAgent@deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot@huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2@huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c127c6a182a3..86b6c29a1bba 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1596,6 +1596,9 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.apptag = cpu_to_le16(io.apptag); c.rw.appmask = cpu_to_le16(io.appmask); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + return nvme_submit_user_cmd(ns->queue, &c, nvme_to_user_ptr(io.addr), length, metadata, meta_len, lower_32_bits(io.slba), NULL, 0); -- 2.22.0