[PATCH v2 0/2] scsi: bsg: fix io_uring passthrough issues

Hi,

Two fixes for the BSG io_uring passthrough path. This is v2 of:

Link: https://lore.kernel.org/r/[email protected] (v1)

Patch 1: the shared SQE is still user-writable on the inline path, so
fields can change between check and use (request_len overflowing
scmd->cmnd). READ_ONCE the fields we validate or consume, and pass
stable map arguments into scsi_bsg_map_user_buffer().

Builds on Rahul Chandelkar's earlier TOCTOU patches:
Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]

Patch 2: IO_URING_F_NONBLOCK only needs BLK_MQ_REQ_NOWAIT for request
allocation; map user buffers with GFP_KERNEL.

Changes in v2:
- Also READ_ONCE max_response_len (Caleb).

Please review.

Thanks,
Yang Xiuwei

Rahul Chandelkar (1):
  scsi: bsg: fix TOCTOU in io_uring passthrough command setup

Yang Xiuwei (1):
  scsi: bsg: map io_uring user buffers with GFP_KERNEL

 drivers/scsi/scsi_bsg.c | 51 ++++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 22 deletions(-)

-- 
2.25.1