scsi: make SG_IO user copyback failure-safe

Several SCSI passthrough completion paths touch userspace while their completed request still owns a queue tag. Sense or READ-bounce copyback can fault on a mapping backed by the same one-tag device, leaving the nested I/O unable to obtain the retained tag. The synchronous and io_uring BSG paths additionally discard data-copyback failures.

Snapshot request-backed completion state, free each request before userspace access, and preserve the existing error precedence while reporting copyback failures. This covers block-device SG_IO, CDDA, and both synchronous and io_uring BSG completion.

Same-device one-tag tests previously left SG_IO, CDDA, and BSG tasks in D state in blk_rq_unmap_user() -> filemap_fault. The fixed paths completed without a stuck task or hung-task report. BSG tests with an unaligned PROT_NONE destination returned false success in 20/20 runs before the error-propagation changes and -EFAULT in 20/20 runs after them, while writable controls continued to succeed.

The series passed scripts/checkpatch.pl --strict, focused W=1 builds, the full bzImage build used for the wider audit, and QEMU differential tests on the affected paths.

Yingjie Wang (6):
scsi: core: release SG_IO request before copying to userspace
scsi: sr: release CDDA request before copying to userspace
scsi: bsg: release synchronous request before user copyback
scsi: bsg: report synchronous data copyback failures
scsi: bsg: release io_uring request before user copyback
scsi: bsg: report io_uring data copyback failures

 drivers/scsi/scsi_bsg.c   | 60 ++++++++++++++++++++++++++-------------
 drivers/scsi/scsi_ioctl.c | 45 ++++++++++++++++++-----------
 drivers/scsi/sr.c         |  3 ++
 3 files changed, 72 insertions(+), 36 deletions(-)

base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053

2.43.0