On Tue, Jul 1, 2025 at 3:23 AM Ming Lei <ming.lei@xxxxxxxxxx> wrote:
>
> Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> need to dereference `io->cmd` for checking if the IO can be added to current
> batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However,
> `io->cmd` may become invalid after the uring_cmd is canceled.
>
> Fixes it by only allowing to queue this IO in case that ublk_prep_req()
> returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid.
>
> Reported-by: Changhui Zhong <czhong@xxxxxxxxxx>
> Fixes: 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
Reviewed-by: Caleb Sander Mateos <csander@xxxxxxxxxxxxxxx>
