[PATCH v2 2/2] scsi: bsg: report io_uring data copyback failures

[Yingjie Wang]

scsi_bsg_uring_task_cb() discards the result of blk_rq_unmap_user(). For a
data-in command that uses a bounce buffer, the task work can therefore
post a CQE with res == 0 despite a copyback failure.

Use the unmap result as the CQE status. A later sense-buffer copy failure
continues to take precedence.

On x86_64, a raw BSG INQUIRY into an unaligned anonymous PROT_NONE
mapping posted a CQE with res == 0 in 20/20 runs before this change and
res == -EFAULT in 20/20 runs afterward. Writable controls succeeded in
20/20 runs on both kernels.

Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/scsi/scsi_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c
index 37393a8dedd84..e4a65d7a23742 100644
--- a/drivers/scsi/scsi_bsg.c
+++ b/drivers/scsi/scsi_bsg.c
@@ -41,7 +41,7 @@ static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw)
 	u8 sense_len_wr = 0;
 
 	if (pdu->bio)
-		blk_rq_unmap_user(pdu->bio);
+		ret = blk_rq_unmap_user(pdu->bio);
 
 	if (scsi_status_is_check_condition(scmd->result)) {
 		driver_status = DRIVER_SENSE;
-- 
2.43.0