[PATCH 0/6] scsi: make SG_IO user copyback failure-safe

[Wang Yingjie <x-professor@outlook.com>]

Several SCSI passthrough completion paths touch userspace while their
completed request still owns a queue tag.  Sense or READ-bounce copyback
can fault on a mapping backed by the same one-tag device, leaving the
nested I/O unable to obtain the retained tag.  The synchronous and
io_uring BSG paths additionally discard data-copyback failures.

Snapshot request-backed completion state, free each request before
userspace access, and preserve the existing error precedence while
reporting copyback failures.  This covers block-device SG_IO, CDDA,
and both synchronous and io_uring BSG completion.

Same-device one-tag tests previously left SG_IO, CDDA, and BSG tasks in
D state in blk_rq_unmap_user() -> filemap_fault.  The fixed paths
completed without a stuck task or hung-task report.  BSG tests with an
unaligned PROT_NONE destination returned false success in 20/20 runs
before the error-propagation changes and -EFAULT in 20/20 runs after
them, while writable controls continued to succeed.

The series passed scripts/checkpatch.pl --strict, focused W=1 builds,
the full bzImage build used for the wider audit, and QEMU differential
tests on the affected paths.

Yingjie Wang (6):
  scsi: core: release SG_IO request before copying to userspace
  scsi: sr: release CDDA request before copying to userspace
  scsi: bsg: release synchronous request before user copyback
  scsi: bsg: report synchronous data copyback failures
  scsi: bsg: release io_uring request before user copyback
  scsi: bsg: report io_uring data copyback failures

 drivers/scsi/scsi_bsg.c   | 60 ++++++++++++++++++++++++++-------------
 drivers/scsi/scsi_ioctl.c | 45 ++++++++++++++++++-----------
 drivers/scsi/sr.c         |  3 ++
 3 files changed, 72 insertions(+), 36 deletions(-)


base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053
-- 
2.43.0