block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd

blkdev_uring_cmd() checks IORING_URING_CMD_REISSUE to determine whether
this is the first issue. However, this flag lives in cmd->flags instead
of issue_flags.

Coincidentally, IO_URING_F_NONBLOCK shares bit 31 with
IORING_URING_CMD_REISSUE. As a result, the SQE read was never performed,
bic->len remained zero, and every BLOCK_URING_CMD_DISCARD failed with
-EINVAL.

Fix it by checking cmd->flags as intended.

Cc: stable@vger.kernel.org
Fixes: 212ec34e4e72 ("block: only read from sqe on initial invocation of blkdev_uring_cmd")
Signed-off-by: Yitang Yang <yi1tang.yang@gmail.com>
Link: https://patch.msgid.link/20260616155129.406057-1-yi1tang.yang@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/ioctl.c b/block/ioctl.c
index ab2c9ed7994683e5f8ca2b68aa91858ff77cf77d..3d4ea1537457d557bdf0eb95182f14a8fb2302a0 100644 (file)
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -951,7 +951,7 @@ int blkdev_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags)
        u32 cmd_op = cmd->cmd_op;
 
        /* Read what we need from the SQE on the first issue */
-       if (!(issue_flags & IORING_URING_CMD_REISSUE)) {
+       if (!(cmd->flags & IORING_URING_CMD_REISSUE)) {
                const struct io_uring_sqe *sqe = cmd->sqe;
 
                if (unlikely(sqe->ioprio || sqe->__pad1 || sqe->len ||