Re: [RFC PATCH 02/10] btrfs: Don't copy encoded read data to user memory when canceled

[sashiko-bot@kernel.org]

> btrfs_uring_read_finished() copies the data of an io_uring encoded read
> to the submitter's buffers with copy_page_to_iter(). It runs as io_uring
> task work, but io_uring may also run it with tw.cancel set from other
> contexts when the submitting task can't run it: from a kworker when the
> submitting task has exited (io_tctx_fallback_work()), or from
> io_cancel_local_task_work() when a DEFER_TASKRUN ring is torn down.
> 
> In a kworker, current->mm is NULL, and the copy does not reliably fail:
> the user half of the address space belongs to whatever mm happens to be
> lazily loaded, if any, so the data may be written into an unrelated
> process.
> 
> Don't copy the data when the task work is canceled, and complete the
> command with -ECANCELED.
> 
> Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
> Signed-off-by: James Houghton <jthoughton@google.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026215226.3713941-1-jthoughton@google.com?part=2