[PATCH 3/4] nvme: report io_uring task-work copyback failures

[王 颖杰]

nvme_uring_task_cb() discards the return from blk_rq_unmap_user().  A
successful data-in command can therefore post CQE 0 even when bounce
data was not copied to the requested userspace destination.

Preserve an earlier NVMe or block error and otherwise report the unmap
error in the CQE.

A real NVMe READ into an unaligned PROT_NONE mapping posted false
success in 20/20 runs before this change and -EFAULT in 20/20 runs
afterward.  Writable controls continued to succeed.

Fixes: 456cba386e94 ("nvme: wire-up uring-cmd support for io-passthru on char-device.")
Cc: stable at vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yingjie Wang <x-professor at outlook.com>
---
 drivers/nvme/host/ioctl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 9b830641a5b..06c3f3232ba 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -439,9 +439,12 @@ static void nvme_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw)
 {
 	struct io_uring_cmd *ioucmd = io_uring_cmd_from_tw(tw_req);
 	struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);
+	int ret = 0;
 
 	if (pdu->bio)
-		blk_rq_unmap_user(pdu->bio);
+		ret = blk_rq_unmap_user(pdu->bio);
+	if (!pdu->status)
+		pdu->status = ret;
 	io_uring_cmd_done32(ioucmd, pdu->status, pdu->result,
 			    IO_URING_CMD_TASK_WORK_ISSUE_FLAGS);
 }
-- 
2.43.0