[PATCH 1/4] nvme: release passthrough resources before user copyback

["王 颖杰" <x-professor@outlook.com>]

blk_rq_unmap_user() may fault while copying READ bounce data to
userspace.  nvme_submit_user_cmd() currently performs that copy while
the completed passthrough request still owns a tag.  If the destination
faults on the same namespace and no other tag is available, the nested
read cannot make progress.

Save the request-backed result, free the request, and finish
command-effect serialization before unmapping the bio.  The saved bio
remains valid independently of the request and can then be copied back
without retaining scarce queue resources or passthrough locks.

With an NVMe I/O queue depth of two, a same-namespace file-backed
destination hung beyond 60 seconds before this change.  It completed
immediately in 20/20 runs afterward, and subsequent normal I/O remained
live.

Fixes: d29ec8241c10 ("nvme: submit internal commands through the block layer")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
---
 drivers/nvme/host/ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 6539d475009..e45572bc87d 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -221,12 +221,12 @@ static int nvme_submit_user_cmd(struct request_queue *q,
 	ret = nvme_execute_rq(req, false);
 	if (result)
 		*result = le64_to_cpu(nvme_req(req)->result.u64);
-	if (bio)
-		blk_rq_unmap_user(bio);
 	blk_mq_free_request(req);
 
 	if (effects)
 		nvme_passthru_end(ctrl, ns, effects, cmd, ret);
+	if (bio)
+		blk_rq_unmap_user(bio);
 	return ret;
 
 out_free_req:
-- 
2.43.0