Skip to content

ublk: snapshot batch commands before preparing I/O#1025

Open
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1119269=>linus-master
Open

ublk: snapshot batch commands before preparing I/O#1025
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1119269=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Jun 30, 2026

Copy link
Copy Markdown

Pull request for series with
subject: ublk: snapshot batch commands before preparing I/O
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1119269

@blktests-ci

blktests-ci Bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1119269
version: 1

@blktests-ci

blktests-ci Bot commented Jul 2, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1119269
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1119269=>linus-master branch from 10d730c to 09fe29e Compare July 2, 2026 12:00
@blktests-ci blktests-ci Bot force-pushed the linus-master_base branch from 90ffd56 to d52f35a Compare July 2, 2026 19:18
@blktests-ci

blktests-ci Bot commented Jul 2, 2026

Copy link
Copy Markdown
Author

Upstream branch: 87320be
series: https://patchwork.kernel.org/project/linux-block/list/?series=1119269
version: 1

The batch prepare path rereads its userspace element array when rolling
back a partially prepared batch. Userspace can change an already
processed tag before the second read, causing rollback to reject the
replacement tag and leave earlier I/O slots prepared. The
WARN_ON_ONCE() in the rollback path then fires.

Copy the bounded batch into kernel memory before changing any I/O state
and use the same snapshot for preparation and rollback. Commit and fetch
batches retain the existing chunked userspace walk.

Fixes: b256795 ("ublk: handle UBLK_U_IO_PREP_IO_CMDS")
Reported-by: syzbot+1a67ee1aa79484801ec6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1a67ee1aa79484801ec6
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
@blktests-ci blktests-ci Bot force-pushed the series/1119269=>linus-master branch from 09fe29e to 93601e3 Compare July 2, 2026 19:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant