Revert "io_uring/uring_cmd: defer SQE copying until it's needed"

JIRA: https://issues.redhat.com/browse/RHEL-82698
CVE: CVE-2025-21837
Upstream status: RHEL-only

This reverts commit 5eff57f.

The upstream fix was different because of follow-on fixes to the buggy
commit.  Rather than backporting more incomplete fixes, just revert the
source of the problem.

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>

Author: JeffMoyer

io_uring/uring_cmd.c

@@ -182,18 +182,12 @@ static int io_uring_cmd_prep_setup(struct io_kiocb *req,
 	struct uring_cache *cache;
 
 	cache = io_uring_async_get(req);
-	if (unlikely(!cache))
-		return -ENOMEM;
-
-	if (!(req->flags & REQ_F_FORCE_ASYNC)) {
-		/* defer memcpy until we need it */
-		ioucmd->sqe = sqe;
+	if (cache) {
+		memcpy(cache->sqes, sqe, uring_sqe_size(req->ctx));
+		ioucmd->sqe = req->async_data;
 		return 0;
 	}
-
-	memcpy(req->async_data, sqe, uring_sqe_size(req->ctx));
-	ioucmd->sqe = req->async_data;
-	return 0;
+	return -ENOMEM;
 }
 
 int io_uring_cmd_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
@@ -251,15 +245,8 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags)
 	}
 
 	ret = file->f_op->uring_cmd(ioucmd, issue_flags);
-	if (ret == -EAGAIN) {
-		struct uring_cache *cache = req->async_data;
-
-		if (ioucmd->sqe != (void *) cache)
-			memcpy(cache, ioucmd->sqe, uring_sqe_size(req->ctx));
-		return -EAGAIN;
-	} else if (ret == -EIOCBQUEUED) {
-		return -EIOCBQUEUED;
-	}
+	if (ret == -EAGAIN || ret == -EIOCBQUEUED)
+		return ret;
 
 	if (ret < 0)
 		req_set_fail(req);