[PATCH 4/6] scsi: bsg: report synchronous data copyback failures

[Wang Yingjie]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

scsi_bsg_sg_io_fn() ignores the result of blk_rq_unmap_user().  A
successful command can therefore return success even though copying READ
bounce data to userspace failed.

Preserve an earlier sense-buffer copy error and otherwise return the
data unmap error.

A virtio-scsi INQUIRY with an unaligned PROT_NONE destination returned
false success in 20/20 runs before this change and -EFAULT in 20/20 runs
afterward.  Writable controls continued to succeed.

Fixes: 10e8855b9451 ("bsg: add SG_IO to SG v4")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/scsi_bsg.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c
index 4937bc494f79..f95dc5da7480 100644
--- a/drivers/scsi/scsi_bsg.c
+++ b/drivers/scsi/scsi_bsg.c
@@ -203,7 +203,7 @@ static int scsi_bsg_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr,
 	u32 scsi_result, resid_len;
 	u8 sense_len;
 	bool is_read;
-	int ret;
+	int ret, unmap_ret;
 
 	if (hdr->protocol != BSG_PROTOCOL_SCSI  ||
 	    hdr->subprotocol != BSG_SUB_PROTOCOL_SCSI_CMD)
@@ -285,7 +285,9 @@ static int scsi_bsg_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr,
 	else
 		hdr->dout_resid = resid_len;
 
-	blk_rq_unmap_user(bio);
+	unmap_ret = blk_rq_unmap_user(bio);
+	if (!ret)
+		ret = unmap_ret;
 	return ret;
 
 out_put_request:
-- 
2.43.0