[PATCH v2 0/6] scsi: release completed passthrough requests before user copyback

[Yingjie Wang]

This rerolls the request-lifetime changes from the original six-patch
series. The independent data-copyback error fixes have already been
posted separately and received Yang Xiuwei's Reviewed-by for the series:

  https://lore.kernel.org/r/cover.1792772194.git.x-professor@xxxxxxxxxxx

This series is based on those two patches applied to mainline
390febb5805d ("Merge tag 'for-7.4-part2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux").
The base and prerequisite patch IDs are recorded below.

Changes since the original series:

- Release completed synchronous requests before sense/data copyback,
  with the request-backed output fields saved first. The original BIO
  chain remains owned by the user mapping until it is unmapped.
- Include SCSI_IOCTL_SEND_COMMAND as a separate fix for the legacy
  sibling identified during review.
- Rework BSG io_uring so end-I/O saves completion state and returns
  RQ_END_IO_FREE. Task work does not use rq or scmd. Optional sense
  storage is allocated and charged to memcg before acquiring the request;
  nonblocking allocation failure returns -EAGAIN for retry.
- Keep the pre-existing sense-length reporting error in a separate
  patch, and bound the new snapshot by its allocated capacity.
- Trace the synchronous lifetime dependency back through the file
  moves to the scsi-mq request pool, rather than a 2005 merge commit.

The old 1/6, 2/6, 3/6 and 5/6 correspond to the new 1/6, 3/6, 4/6 and
6/6. The new 2/6 and 5/6 address the legacy ioctl and sense-length
reporting respectively. Transport BSG remains outside this series: its
separate queue needs its own resource-dependency analysis.

Validation used matching x86-64 KASAN/lockdep configurations with QEMU
and virtual SCSI disk/CD-ROM devices. Before this series, 20/20 traced
DEFER_TASKRUN completions retained their request before task work ran;
afterward, the request was released in that window. The tests also
cover synchronous ioctls, sense/data copy errors, fixed buffers, io-wq,
pending-ring close, and fault-injected allocation failures. CDDA testing
exercised the virtual device's error path, not successful audio extraction
from real media. Each intermediate commit was built independently; i386
and modular SCSI with IO_URING disabled were also object-built.

The earlier one-tag fault results are historical evidence, not newly
rerun deadlock tests of this revision. The dependency when completed
requests retain all tags available to nested I/O is a source-level
argument; it is not a claim of a new multi-tag exhaustion experiment.


v1: https://lore.kernel.org/r/cover.1792237341.git.x-professor@xxxxxxxxxxx
Review follow-up: https://lore.kernel.org/r/20261022.scsi-copyback-review.31b8d6a70f4c@xxxxxxxxxxx
CDDA reply: https://lore.kernel.org/r/20261022.scsi-cdda-lifetime.8f31a2c97b42@xxxxxxxxxxx

Yingjie Wang (6):
  scsi: core: release SG_IO request before user copyback
  scsi: core: release legacy ioctl request before user copyback
  scsi: sr: release CDDA request before user copyback
  scsi: bsg: release synchronous request before user copyback
  scsi: bsg: clear io_uring sense length on copy failure
  scsi: bsg: release io_uring requests in end-I/O

 drivers/scsi/scsi_bsg.c   | 102 ++++++++++++++++++++++++--------------
 drivers/scsi/scsi_ioctl.c |  34 +++++++++----
 drivers/scsi/sr.c         |   3 ++
 3 files changed, 92 insertions(+), 47 deletions(-)


base-commit: 390febb5805d3bb830402679f277f1d5f309e6bc
prerequisite-patch-id: 8dbaa81edcd4c0acbe43169d7d1c7012f6bec995
prerequisite-patch-id: 321b182025cad20ba75cc00122e50daba8d1a52f
-- 
2.43.0