[PATCH 0/4] nvme: make passthrough user copyback failure-safe

[王 颖杰]

NVMe passthrough completion currently calls blk_rq_unmap_user() while
the completed request can still own a queue tag.  A copyback page fault
that needs I/O from the same low-depth namespace can therefore wait for
the tag held by the request performing the copyback.  The synchronous,
task-work, and local IOPOLL paths also discard copyback failures.

Release the request before synchronous and local-IOPOLL user copyback,
and propagate copyback failures through the ioctl or io_uring CQE when
there is no earlier command error.  Keep nvme_passthru_end() based on the
real controller result rather than a later userspace-copy error.

With an NVMe I/O queue depth of two, a same-namespace file-backed
destination hung beyond 60 seconds before patch 1 and completed in 20/20
runs afterward.  Unaligned PROT_NONE destinations returned false success
before the error-reporting changes and -EFAULT afterward.  The local
IOPOLL test returned -EFAULT for all 1,280 commands, while writable
controls continued to succeed.

The series passed scripts/checkpatch.pl --strict, focused W=1 builds,
the full bzImage build used for the wider audit, and QEMU differential
tests on the affected completion paths.

Yingjie Wang (4):
  nvme: release passthrough resources before user copyback
  nvme: report synchronous passthrough copyback failures
  nvme: report io_uring task-work copyback failures
  nvme: harden local IOPOLL user copyback

 drivers/nvme/host/ioctl.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)


base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053
-- 
2.43.0