From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.199 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793051569; b=0MYbqWmBpeAFtNeE9o+fR+9eTdOEcCQ+qDRQFnU94bFadtwtEpWiIn88uEOQuFfXbe5s GL3FZpMZX6Uz73r//bSqcY55f9B1yHGXZXcDwpJYAK0xvCGCNK5TDmWe6WffXz4B3r62t rjEu6Z17bg3BKFSCpVJ5dPSzXxXyL2BvgP7EG/FKKo0n0XpRwQswuLJmSO/5CYvOem/96 /GwaJ+96ERHAMGO0mmNDZsHaUkOmlTTUwxoUGSAeff7zY82oBd9aR6miPrqL/XfzoWN5G Ac4dEU/XBxg/1ZtftmY9E80zvXJ4vbI/oEovfr6iR/V+ru0f/dL47pNwwXlk9kIt6FA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793051569; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=RD5MWqHEB8iYDLFdQXvkJ0xSc6fsoJ0ZXufXHQQ7zgM=; b=hr43hYyrdhh0TH8vHFCXCqo4jkR89lXrVMyJjaVjlIJB4EcQnBDcWKrHAqhBpCRkqQZ4 uYgM5fHlXOSYOaLnOCPrGgCcSxbzWD5qLquT4biXqTsxowd3sfVRwjGMFU+ysFpxkFQMH qKIqMfRc+rHQVDMNOvh0Kt6ZbfLZNJ5IdnbWJZ1pzd0eKSLGDPUNPo5CDUOA+rxMsc4yX jADEjx91YkbDJEGJ1sVIWCoYhYBxtUo3lhUG5oEUx5AWcOZ2YFFxwwj0/t/wXp+f5nL6N jJ9q4JiEndAkFxaH7Sc09ep5c0Gfh5zW4mrJFmeD8y3VLr+c7ELf0S1c/Vf3bzN9OeQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=ttuByBgZ; arc=none smtp.remote-ip=209.85.214.199 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98DA3606A333 for ; Mon, 26 Oct 2026 21:52:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 98DA3606A333 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=ttuByBgZ Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2e818ca61bfso36138425ad.2 for ; Mon, 26 Oct 2026 14:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1793051569; x=1793656369; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=RD5MWqHEB8iYDLFdQXvkJ0xSc6fsoJ0ZXufXHQQ7zgM=; b=ttuByBgZyXhz+vCIDU5aBy90hRWqwioXsk1DTyafweNnvz2VRwJpnWhZTDjU/ruhRF +eNkpq2S/OLTAC4WKDyiSOVdOZpoaInxvu9UjK8OVtqVOVGoXQz0xw4USi3sYBtAAjKW xFkNF7RtNx3C8ylvzrtr3yIDJFmQr5Fpx5GMG7lg7Zxkb9Zz76slRyBARq30C4fj/GZc lewXB4OZG8GXpxXvg/Z2Si+lR9m0f1WY60ZFwIRoGIQ8gBxO4HkEYP6M2T1bDHZOH6bh LsWrGaMFI/TsCQGQozWRU1Jk+J5GWR7q6ZBrNLB6qEnTv5RGoUe2N/rfxG8p6ofbEptr 6CiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793051569; x=1793656369; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RD5MWqHEB8iYDLFdQXvkJ0xSc6fsoJ0ZXufXHQQ7zgM=; b=sB8VG9mCMuJ7L4kp5QHT2XgFkXeNGvq4hZcNECZSL/vu5longw8hAYY/AEXnIfLNbk O0qLFrVI/B1NlzxXXeZK2+HIvenrg32DgbkjZ+HE+/PQYlWo4HQLSLYcbhUW5Yx5xF1u UIaFN6MMr867Tyceix0Zn9lEMTee2pLuLFs2h0xrhoN0aTz43HcUg5opsJB86zW7Hkc7 0bmS8gF+EgB5e9Ly4/sdz8IXP0ZQplMAWXO/d0PVliqsRkIAqVQiI6msF9NJWKW5fYA0 XyDayr1WJq0/RFvopRiPoh0SKBLgGfThhZMf+2VOWB4L8Xc4zgTUKBuiPfqes3CH3/cK 5dPQ== X-Forwarded-Encrypted: i=1; AKwUvBza3DvtNnbWM3TQemexwHy38MAj8+7hTPGwRAO2O34LOHcGR3GZZIg651orEgy6du6DdPU=@vger.kernel.org X-Gm-Message-State: AFq9FYLjPMwftjegjrxeQjLlf/SPKOHP5Y4SMiwJsi90FIvPPNcEXgc5 F+mhG7/7GQ0/SRoBljKsqxTTKyvoV1adRtHV7S5iqftNbju24WuGuMI7ZJvykURQPzJ3MKSlSSr mDeN6xovetZaY/I34RtBSVg== X-Received: from pjps6.prod.google.com ([2002:a17:90a:a106:b0:3ad:c8d8:70c3]) (user=jthoughton job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:2688:b0:3a8:cb54:e135 with SMTP id 98e67ed59e1d1-3adea899125mr6172313a91.19.1793051568668; Mon, 26 Oct 2026 14:52:48 -0700 (PDT) Date: Mon, 26 Oct 2026 21:52:17 +0000 In-Reply-To: <20261026215226.3713941-1-jthoughton@google.com> X-Mailing-List: kvm@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261026215226.3713941-1-jthoughton@google.com> X-Mailer: git-send-email 2.56.0.307.g5fe7bd680c-goog Message-ID: <20261026215226.3713941-2-jthoughton@google.com> Subject: [RFC PATCH 01/10] scsi: bsg: Don't copy sense data to user memory when canceled From: James Houghton To: Andrew Morton , Alexander Viro Cc: Thomas Gleixner , Peter Zijlstra , Kees Cook , Arnd Bergmann , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Sean Christopherson , Paolo Bonzini , Jim Mattson , Jens Axboe , Pavel Begunkov , "James E.J. Bottomley" , "Martin K. Petersen" , David Sterba , Chris Mason , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Josh Poimboeuf , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, kvm@vger.kernel.org, io-uring@vger.kernel.org, linux-scsi@vger.kernel.org, linux-btrfs@vger.kernel.org, bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, James Houghton Content-Type: text/plain; charset="UTF-8" scsi_bsg_uring_task_cb() copies the sense data to the submitter's response_addr with copy_to_user(). It runs as io_uring task work, but io_uring may also run it with tw.cancel set from other contexts when the submitting task can't run it: from a kworker when the submitting task has exited (io_tctx_fallback_work()), or from io_cancel_local_task_work() when a DEFER_TASKRUN ring is torn down. In a kworker, current->mm is NULL, and the copy does not reliably fail: the user half of the address space belongs to whatever mm happens to be lazily loaded, if any, so up to max_response_len bytes of sense data may be written into an unrelated process. Don't copy the sense data when the task work is canceled, and complete the command with -ECANCELED. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Signed-off-by: James Houghton --- drivers/scsi/scsi_bsg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c index 5eec248a77a6..3755e33fcdd2 100644 --- a/drivers/scsi/scsi_bsg.c +++ b/drivers/scsi/scsi_bsg.c @@ -43,9 +43,17 @@ static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw) if (pdu->bio) blk_rq_unmap_user(pdu->bio); + /* + * If the request is being canceled, e.g. because the submitting task + * has exited, this may run from a kworker or in a different task, so + * don't copy the sense data to the submitter's address. + */ + if (unlikely(tw.cancel)) + ret = -ECANCELED; + if (scsi_status_is_check_condition(scmd->result)) { driver_status = DRIVER_SENSE; - if (pdu->response_addr) + if (pdu->response_addr && !tw.cancel) sense_len_wr = min_t(unsigned int, pdu->max_response_len, scmd->sense_len); } -- 2.56.0.307.g5fe7bd680c-goog