linux-kernel - Re: [PATCH][SCSI] scsi-mq: fix requests that use a separate CDB buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 23 Aug 2014 15:09:32 -0400
From:	Douglas Gilbert <dgilbert@...erlog.com>
To:	Tony Battersby <tonyb@...ernetics.com>, linux-scsi@...r.kernel.org,
	"James E.J. Bottomley" <JBottomley@...allels.com>,
	Jens Axboe <axboe@...nel.dk>
CC:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH][SCSI] scsi-mq: fix requests that use a separate CDB buffer

On 14-08-22 03:53 PM, Tony Battersby wrote:
> This patch fixes code such as the following with scsi-mq enabled:
>
>      rq = blk_get_request(...);
>      blk_rq_set_block_pc(rq);
>
>      rq->cmd = my_cmd_buffer; /* separate CDB buffer */
>
>      blk_execute_rq_nowait(...);
>
> Code like this appears in e.g. sg_start_req() in drivers/scsi/sg.c (for
> large CDBs only).  Without this patch, scsi_mq_prep_fn() will set
> rq->cmd back to rq->__cmd, causing the wrong CDB to be sent to the device.
>
> Signed-off-by: Tony Battersby <tonyb@...ernetics.com>

Tested-by: Douglas Gilbert <dgilbert@...erlog.com>


Patch tested on lk 3.17-rc1 with the sg driver using
the READ(32) command.

> For inclusion in 3.17 only.

May want to check if blk-mq work in lk 3.16 and earlier
breaks the bsg driver's capability to send SCSI cdbs
that are longer than 16 bytes.

> diff -urpN linux-3.17.0-rc1-a/block/blk-core.c linux-3.17.0-rc1-b/block/blk-core.c
> --- linux-3.17.0-rc1-a/block/blk-core.c	2014-08-16 12:40:26.000000000 -0400
> +++ linux-3.17.0-rc1-b/block/blk-core.c	2014-08-22 14:03:33.000000000 -0400
> @@ -1252,7 +1252,6 @@ void blk_rq_set_block_pc(struct request
>   	rq->__sector = (sector_t) -1;
>   	rq->bio = rq->biotail = NULL;
>   	memset(rq->__cmd, 0, sizeof(rq->__cmd));
> -	rq->cmd = rq->__cmd;
>   }
>   EXPORT_SYMBOL(blk_rq_set_block_pc);
>
> diff -urpN linux-3.17.0-rc1-a/block/blk-mq.c linux-3.17.0-rc1-b/block/blk-mq.c
> --- linux-3.17.0-rc1-a/block/blk-mq.c	2014-08-16 12:40:26.000000000 -0400
> +++ linux-3.17.0-rc1-b/block/blk-mq.c	2014-08-22 14:02:32.000000000 -0400
> @@ -172,6 +172,8 @@ static void blk_mq_rq_ctx_init(struct re
>   	/* tag was already set */
>   	rq->errors = 0;
>
> +	rq->cmd = rq->__cmd;
> +
>   	rq->extra_len = 0;
>   	rq->sense_len = 0;
>   	rq->resid_len = 0;
> diff -urpN linux-3.17.0-rc1-a/drivers/scsi/scsi_lib.c linux-3.17.0-rc1-b/drivers/scsi/scsi_lib.c
> --- linux-3.17.0-rc1-a/drivers/scsi/scsi_lib.c	2014-08-16 12:40:26.000000000 -0400
> +++ linux-3.17.0-rc1-b/drivers/scsi/scsi_lib.c	2014-08-22 14:02:32.000000000 -0400
> @@ -1808,7 +1808,6 @@ static int scsi_mq_prep_fn(struct reques
>
>   	cmd->tag = req->tag;
>
> -	req->cmd = req->__cmd;
>   	cmd->cmnd = req->cmd;
>   	cmd->prot_op = SCSI_PROT_NORMAL;
>
>
> --


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/