From: Yingjie Wang sr_read_cdda_bpc() calls blk_rq_unmap_user() while its completed request still owns the only queue tag. For an unaligned READ buffer, unmap copies bounce data to userspace and can fault on a nonresident mapping of the same CD-ROM. The nested read then waits for the tag held by the outer request. Free the request after saving all request-backed state and before copying the retained bio back to userspace. The standalone CDROMREADAUDIO reproducer previously remained in D state in sr_read_cdda_bpc -> blk_rq_unmap_user -> filemap_fault and blocked the disk-events worker in blk_mq_get_tag. With this change it returned immediately, left no stuck process, and produced no hung-task report. Fixes: 31151ba2cef1 ("fix mismerge in ll_rw_blk.c") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Yingjie Wang --- drivers/scsi/sr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c index c36c54ecd354..de43d6e56479 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -968,8 +968,11 @@ static int sr_read_cdda_bpc(struct cdrom_device_info *cdi, void __user *ubuf, ret = -EIO; } + blk_mq_free_request(rq); if (blk_rq_unmap_user(bio)) ret = -EFAULT; + return ret; + out_put_request: blk_mq_free_request(rq); return ret; -- 2.43.0