[PATCH 6/6] scsi: bsg: report io_uring data copyback failures

[Wang Yingjie]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

scsi_bsg_uring_task_cb() discards the return from blk_rq_unmap_user().
A successful data-in command can therefore post CQE 0 even when bounce
data was not delivered to userspace.

Use the unmap result as the CQE status.  A later sense-buffer copy
failure remains -EFAULT as before.

A raw BSG INQUIRY into an unaligned anonymous PROT_NONE mapping posted
false success in 20/20 runs before this change and -EFAULT in 20/20 runs
afterward.  Writable controls continued to succeed.

Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/scsi_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c
index 341142dda71d..f776c4a74fb3 100644
--- a/drivers/scsi/scsi_bsg.c
+++ b/drivers/scsi/scsi_bsg.c
@@ -54,7 +54,7 @@ static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw)
 
 	blk_mq_free_request(rq);
 	if (pdu->bio)
-		blk_rq_unmap_user(pdu->bio);
+		ret = blk_rq_unmap_user(pdu->bio);
 
 	if (sense_len_wr) {
 		if (copy_to_user(uptr64(pdu->response_addr), sense_buffer,
-- 
2.43.0