[PATCH v4 0/3] scsi: bsg: io_uring passthrough fixes

Hi,

Three patches for the BSG io_uring passthrough path.

1/3: cap sense copy to max_response_len (and stop stuffing that
limit into scmd->sense_len). Noted by sashiko on v3:
Link: https://lore.kernel.org/linux-scsi/[email protected]/

2/3: fix TOCTOU on the shared SQE.

Builds on Rahul Chandelkar's earlier TOCTOU patches:
Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]

3/3: IO_URING_F_NONBLOCK only needs BLK_MQ_REQ_NOWAIT for request
allocation. Map user buffers with GFP_KERNEL.

Changes in v4:
- Add 1/3 sense copy fix; put it first so TOCTOU does not need to
  READ_ONCE max_response_len for a single PDU store.
- Reorder: sense, TOCTOU, GFP_KERNEL.
Link: https://lore.kernel.org/r/[email protected]

Changes in v3:
- Reword TOCTOU commit message.
Link: https://lore.kernel.org/r/[email protected]

Changes in v2:
- Also READ_ONCE fields used across check/use (Caleb).
Link: https://lore.kernel.org/r/[email protected]

Yang Xiuwei (2):
  scsi: bsg: cap io_uring sense copy to max_response_len
  scsi: bsg: map io_uring user buffers with GFP_KERNEL

Rahul Chandelkar (1):
  scsi: bsg: fix TOCTOU in io_uring passthrough command setup

 drivers/scsi/scsi_bsg.c | 54 +++++++++++++++++++++++++++----------------------
 1 file changed, 30 insertions(+), 24 deletions(-)

-- 
2.25.1