Re: [PATCH] ublk: snapshot batch commands before preparing I/O

[Ming Lei]

On Tue, Jun 30, 2026 at 4:18 PM Yousef Alhouseen
<alhouseenyousef@xxxxxxxxx> wrote:
>
> The batch prepare path rereads its userspace element array when rolling
> back a partially prepared batch. Userspace can change an already
> processed tag before the second read, causing rollback to reject the
> replacement tag and leave earlier I/O slots prepared. The
> WARN_ON_ONCE() in the rollback path then fires.
>
> Copy the bounded batch into kernel memory before changing any I/O state
> and use the same snapshot for preparation and rollback. Commit and fetch
> batches retain the existing chunked userspace walk.
>
> Fixes: b256795b3606 ("ublk: handle UBLK_U_IO_PREP_IO_CMDS")
> Reported-by: syzbot+1a67ee1aa79484801ec6@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1a67ee1aa79484801ec6
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>

The fix looks fine, given the copy is only added in prep stage, which
isn't part of fast io path:

Reviewed-by: Ming Lei <tom.leiming@xxxxxxxxx>



Thanks,
Ming Lei