Re: [PATCH 1/2] scsi: bsg: fix TOCTOU in io_uring passthrough command setup

Hi Caleb,

On Thu, Jul 23, 2026 at 09:56:08AM -0700, Caleb Sander Mateos wrote:
> cmd->max_response_len is passed through here, shouldn't it be accessed
> using READ_ONCE() too? Omitting READ_ONCE() only seems safe for values
> that are ignored (except for a possible check that they match a fixed
> value).
>
> Ditto for cmd->timeout_ms later in this function.

timeout_ms is the example Jens already called out as not mattering if
userspace rewrites the SQE:

  https://lore.kernel.org/r/[email protected]

max_response_len is similar here: we clamp with
min(..., SCSI_SENSE_BUFFERSIZE), so it cannot overflow the sense
buffer. Same idea for response.

Thanks,
Yang Xiuwei