With UBLK_F_AUTO_BUF_REG, ublk_config_io_buf() may fail on invalid auto buffer register data in sqe->addr. Calling ublk_fill_io_cmd() first leaves UBLK_IO_FLAG_ACTIVE set while io_uring has already completed the uring_cmd. The tag can no longer be fetched, and device teardown may hang or complete a stale command. Fixes: 52460dda3a77 ("ublk: move auto buffer register handling into one dedicated helper") Signed-off-by: Yang Xiuwei --- drivers/block/ublk_drv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index c2c11f2a01e7..d932a4026031 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -3295,9 +3295,9 @@ static int ublk_fetch(struct io_uring_cmd *cmd, struct ublk_device *ub, * FETCH, so it is fine even for IO_URING_F_NONBLOCK. */ mutex_lock(&ub->mutex); - ret = __ublk_fetch(cmd, ub, io, q_id); + ret = ublk_config_io_buf(ub, io, cmd, buf_addr, NULL); if (!ret) - ret = ublk_config_io_buf(ub, io, cmd, buf_addr, NULL); + ret = __ublk_fetch(cmd, ub, io, q_id); if (!ret) ublk_mark_io_ready(ub, q_id, io); mutex_unlock(&ub->mutex); @@ -3447,19 +3447,18 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, if (ret) goto out; io->res = result; - req = ublk_fill_io_cmd(io, cmd); ret = ublk_config_io_buf(ub, io, cmd, addr, &buf_idx); if (buf_idx != UBLK_INVALID_BUF_IDX) io_buffer_unregister_bvec(cmd, buf_idx, issue_flags); + if (ret) + goto out; + req = ublk_fill_io_cmd(io, cmd); compl = ublk_need_complete_req(ub, io); if (req_op(req) == REQ_OP_ZONE_APPEND) req->__sector = addr; if (compl) __ublk_complete_rq(req, io, ublk_dev_need_map_io(ub), NULL); - - if (ret) - goto out; break; case UBLK_IO_NEED_GET_DATA: /* -- 2.25.1