[PATCH v2 5/6] scsi: bsg: clear io_uring sense length on copy failure

[Yingjie Wang]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

The SCSI BSG io_uring completion reports sense_len_wr in res2 as the
number of sense bytes written to the response buffer. If copy_to_user()
fails, the callback returns -EFAULT but leaves that field nonzero.

Clear the reported sense length on a failed copy, matching the
synchronous BSG and SG_IO interfaces. This reporting error predates the
request-lifetime changes and can be fixed independently.

Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler")
Link: https://lore.kernel.org/r/20261022.scsi-copyback-review.31b8d6a70f4c@xxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/scsi_bsg.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c
index 650facb16ed23..98c9db1cae653 100644
--- a/drivers/scsi/scsi_bsg.c
+++ b/drivers/scsi/scsi_bsg.c
@@ -52,8 +52,10 @@ static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw)
 
 	if (sense_len_wr) {
 		if (copy_to_user(uptr64(pdu->response_addr), scmd->sense_buffer,
-				 sense_len_wr))
+				 sense_len_wr)) {
 			ret = -EFAULT;
+			sense_len_wr = 0;
+		}
 	}
 
 	res2 = bsg_scsi_res2_build(status_byte(scmd->result), driver_status,
-- 
2.43.0