unsigned int index, unsigned int issue_flags)
 {
        struct ublk_device *ub = cmd->file->private_data;
-       const struct ublk_io *io = &ubq->ios[tag];
        struct request *req;
        int ret;
 
        if (!ublk_support_zero_copy(ubq))
                return -EINVAL;
 
-       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
-               return -EINVAL;
-
        req = __ublk_check_and_get_req(ub, ubq, tag, 0);
        if (!req)
                return -EINVAL;
 }
 
 static int ublk_unregister_io_buf(struct io_uring_cmd *cmd,
-                                 const struct ublk_queue *ubq, unsigned int tag,
+                                 const struct ublk_queue *ubq,
                                  unsigned int index, unsigned int issue_flags)
 {
-       const struct ublk_io *io = &ubq->ios[tag];
-
        if (!ublk_support_zero_copy(ubq))
                return -EINVAL;
 
-       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
-               return -EINVAL;
-
        return io_buffer_unregister_bvec(cmd, index, issue_flags);
 }
 
                                 struct ublk_io *io, struct io_uring_cmd *cmd,
                                 const struct ublksrv_io_cmd *ub_cmd)
 {
-       struct request *req;
-
-       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
-               return -EINVAL;
+       struct request *req = io->req;
 
-       req = io->req;
        if (ublk_need_map_io(ubq)) {
                /*
                 * COMMIT_AND_FETCH_REQ has to provide IO buffer if
                goto out;
        }
 
+       /* only UBLK_IO_FETCH_REQ is allowed if io is not OWNED_BY_SRV */
+       if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV) &&
+           _IOC_NR(cmd_op) != UBLK_IO_FETCH_REQ)
+               goto out;
+
        /*
         * ensure that the user issues UBLK_IO_NEED_GET_DATA
         * iff the driver have set the UBLK_IO_FLAG_NEED_GET_DATA.
        case UBLK_IO_REGISTER_IO_BUF:
                return ublk_register_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);
        case UBLK_IO_UNREGISTER_IO_BUF:
-               return ublk_unregister_io_buf(cmd, ubq, tag, ub_cmd->addr, issue_flags);
+               return ublk_unregister_io_buf(cmd, ubq, ub_cmd->addr, issue_flags);
        case UBLK_IO_FETCH_REQ:
                ret = ublk_fetch(cmd, ubq, io, ub_cmd->addr);
                if (ret)
                        goto out;
                break;
        case UBLK_IO_NEED_GET_DATA:
-               if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV))
-                       goto out;
                io->addr = ub_cmd->addr;
                if (!ublk_get_data(ubq, io))
                        return -EIOCBQUEUED;