From: Yingjie Wang scsi_bsg_sg_io_fn() ignores the result of blk_rq_unmap_user(). A successful command can therefore return success even though copying READ bounce data to userspace failed. Preserve an earlier sense-buffer copy error and otherwise return the data unmap error. A virtio-scsi INQUIRY with an unaligned PROT_NONE destination returned false success in 20/20 runs before this change and -EFAULT in 20/20 runs afterward. Writable controls continued to succeed. Fixes: 10e8855b9451 ("bsg: add SG_IO to SG v4") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Yingjie Wang --- drivers/scsi/scsi_bsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c index 4937bc494f79..f95dc5da7480 100644 --- a/drivers/scsi/scsi_bsg.c +++ b/drivers/scsi/scsi_bsg.c @@ -203,7 +203,7 @@ static int scsi_bsg_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr, u32 scsi_result, resid_len; u8 sense_len; bool is_read; - int ret; + int ret, unmap_ret; if (hdr->protocol != BSG_PROTOCOL_SCSI || hdr->subprotocol != BSG_SUB_PROTOCOL_SCSI_CMD) @@ -285,7 +285,9 @@ static int scsi_bsg_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr, else hdr->dout_resid = resid_len; - blk_rq_unmap_user(bio); + unmap_ret = blk_rq_unmap_user(bio); + if (!ret) + ret = unmap_ret; return ret; out_put_request: -- 2.43.0