Re: [PATCH 0/6] scsi: make SG_IO user copyback failure-safe

[Yingjie Wang]

Hi Bart,

Thanks for the detailed review. I checked the relevant paths against
the series base, 0fcb05b72344.

You're right about the request/tag-retention window in patch 5/6. It
still returns RQ_END_IO_NONE, so moving blk_mq_free_request() to the
beginning of task work does not address the window before task work
runs.

For the reroll, I plan to preallocate the required sense storage at
submission and save the request-backed completion state in
scsi_bsg_uring_cmd_done(). This would let end-I/O return
RQ_END_IO_FREE, while task work handles the unmap, user copies and CQE
completion without accessing rq or scmd. I'll check the allocation and
cleanup paths, including nonblocking submission, and retest with
IORING_SETUP_DEFER_TASKRUN.

The tag/fault dependency itself is not limited to a one-tag queue; it
can also arise if completed requests retain all tags available to the
nested fault I/O. So far, however, I have only reproduced the one-tag
case at runtime. I'll make that distinction explicit in the cover
letter.

For the sense data, I'll bound the snapshot by its storage size even
though valid-sense processing in the midlayer caps the computed length.
The existing sense_len_wr behavior on copy failure predates this
series, so that should be a separate fix.

I also found the same copy-before-free ordering in sg_scsi_ioctl() and
will validate that path as part of the lifetime reroll.
bsg_transport_sg_io_fn() uses a separate transport BSG queue, so I do
not want to claim the same demonstrated deadlock there without a
separate audit.

Patches 4/6 and 6/6 are independent copyback-error fixes. I'll split
them out so they are not held up by the larger lifetime rework. I also
need to recheck the lifecycle-related Fixes tags across the earlier
implementations and file moves.

Thanks,
Yingjie