[PATCH 0/2] scsi: bsg: fix io_uring passthrough issues

Hi,

Two fixes for the BSG io_uring passthrough path.

Patch 1 addresses a TOCTOU where the shared SQE can change request_len
between validation and copy_from_user(), overflowing scmd->cmnd. This
is a v3 of Rahul Chandelkar's series, taking over after no follow-up to
v2. Relative to v2, READ_ONCE is limited to fields used for validation
and buffer mapping, as requested in review.

Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]

Patch 2 uses GFP_KERNEL for user-buffer mapping. IO_URING_F_NONBLOCK
still sets BLK_MQ_REQ_NOWAIT so request-tag allocation does not block;
mapping itself may sleep and need not use GFP_NOWAIT.

Changes for patch 1 since Rahul's v2:
- READ_ONCE only request/request_len and dout/din xfer fields.
- Pass stable map arguments into scsi_bsg_map_user_buffer().

Please review.

Thanks,
Yang Xiuwei

Rahul Chandelkar (1):
  scsi: bsg: fix TOCTOU in io_uring passthrough command setup

Yang Xiuwei (1):
  scsi: bsg: map io_uring user buffers with GFP_KERNEL

 drivers/scsi/scsi_bsg.c | 47 +++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

-- 
2.25.1