[PATCH v2 3/6] scsi: sr: release CDDA request before user copyback

[Yingjie Wang]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

sr_read_cdda_bpc() retains its completed request while unmapping the user
buffer. For a bounced data-in mapping, unmapping can copy to userspace
and fault. A fault that needs I/O from the same queue cannot progress if
the completed request retains the available tag.

Release the request after consuming its command result and sense data,
before unmapping the original BIO chain saved at submission. No request
or SCSI command field is accessed after the release. The mapping's BIO
references remain owned by blk_rq_unmap_user().

The scsi-mq request pool introduced this tag dependency. The later move
of the CDDA implementation from drivers/cdrom into sr was a relocation.

Fixes: d285203cf647 ("scsi: add support for a blk-mq based I/O path.")
Link: https://lore.kernel.org/r/20261022.scsi-cdda-lifetime.8f31a2c97b42@xxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/sr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 4f2e8d1be6da8..c64c25e9f4047 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -969,8 +969,11 @@ static int sr_read_cdda_bpc(struct cdrom_device_info *cdi, void __user *ubuf,
 		ret = -EIO;
 	}
 
+	blk_mq_free_request(rq);
 	if (blk_rq_unmap_user(bio))
 		ret = -EFAULT;
+	return ret;
+
 out_put_request:
 	blk_mq_free_request(rq);
 	return ret;
-- 
2.43.0