Re: [PATCH v3 0/2] scsi: bsg: io_uring passthrough TOCTOU and mapping

Hi,

sashiko noted a sense buffer overflow on the io_uring path:
Link: https://lore.kernel.org/linux-scsi/[email protected]/

Agreed. Completion copies scmd->sense_len without capping to
max_response_len. Setting sense_len at submit does not help; the
midlayer overwrites it with the real sense length.

I will add a fix as 3/3 in v4 (store max_response_len in the PDU and
cap the copy like the ioctl path).

Thanks,
Yang Xiuwei