[PATCH 2/6] scsi: sr: release CDDA request before copying to userspace

[Wang Yingjie]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

sr_read_cdda_bpc() calls blk_rq_unmap_user() while its completed request
still owns the only queue tag.  For an unaligned READ buffer, unmap
copies bounce data to userspace and can fault on a nonresident mapping
of the same CD-ROM.  The nested read then waits for the tag held by the
outer request.

Free the request after saving all request-backed state and before
copying the retained bio back to userspace.

The standalone CDROMREADAUDIO reproducer previously remained in D state
in sr_read_cdda_bpc -> blk_rq_unmap_user -> filemap_fault and blocked
the disk-events worker in blk_mq_get_tag.  With this change it returned
immediately, left no stuck process, and produced no hung-task report.

Fixes: 31151ba2cef1 ("fix mismerge in ll_rw_blk.c")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/sr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index c36c54ecd354..de43d6e56479 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -968,8 +968,11 @@ static int sr_read_cdda_bpc(struct cdrom_device_info *cdi, void __user *ubuf,
 		ret = -EIO;
 	}
 
+	blk_mq_free_request(rq);
 	if (blk_rq_unmap_user(bio))
 		ret = -EFAULT;
+	return ret;
+
 out_put_request:
 	blk_mq_free_request(rq);
 	return ret;
-- 
2.43.0