linux-kernel - Re: [PATCH] scsi: core: Cap shost cmd_per_lun at can

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 May 2021 17:41:15 +0100
From:   John Garry <john.garry@...wei.com>
To:     Bart Van Assche <bvanassche@....org>, <jejb@...ux.ibm.com>,
        <martin.petersen@...cle.com>
CC:     <linux-scsi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <ming.lei@...hat.com>
Subject: Re: [PATCH] scsi: core: Cap shost cmd_per_lun at can_queue

On 20/05/2021 16:57, Bart Van Assche wrote:
> On 5/19/21 7:31 AM, John Garry wrote:
>> Function sdev_store_queue_depth() enforces that the sdev queue depth cannot
>> exceed Shost.can_queue.
>>
>> The sdev initial value comes from shost cmd_per_lun.
>>
>> However, the LLDD may still set cmd_per_lun > can_queue, which leads to an
>> initial sdev queue depth greater than can_queue.
>>
>> Such an issue was reported in [0], which caused a hang. That has since
>> been fixed in commit fc09acb7de31 ("scsi: scsi_debug: Fix cmd_per_lun,
>> set to max_queue").
>>
>> Stop this possibly happening for other drivers by capping
>> shost.cmd_per_lun at shost.can_queue.
>>
>> [0] https://lore.kernel.org/linux-scsi/YHaez6iN2HHYxYOh@T590/
>>
>> Signed-off-by: John Garry <john.garry@...wei.com>
>> ---
>> Earlier patch was in https://lore.kernel.org/linux-scsi/1618848384-204144-1-git-send-email-john.garry@huawei.com/
>>
>> diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
>> index ba72bd4202a2..624e2582c3df 100644
>> --- a/drivers/scsi/hosts.c
>> +++ b/drivers/scsi/hosts.c
>> @@ -220,6 +220,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
>>   		goto fail;
>>   	}
>>   
>> +	shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
>> +				   shost->can_queue);
>> +
>>   	error = scsi_init_sense_cache(shost);
>>   	if (error)
>>   		goto fail;
> 
> 

Hi Bart,

> In SCSI header files a mix of int, short and unsigned int is used for
> cmd_per_lun and can_queue. How about changing the types of these two
> member variables in include/scsi/*h into u16?
I don't mind doing that, but is there any requirement for can_queue to 
not be limited to 16b?

It seems intentional that can_queue is int and cmd_per_lun is short.

As an aside, if short is 16b, it does not even seem to have efficient 
packing on Scsi_host today (although we can move things around):

int can_queue;
short cmd_per_lun;
short unsigned int sg_tablesize;
short unsigned int sg_prot_tablesize;
/* 16b hole */
unsigned int max_sectors;

> 
> Anyway:
> 
> Reviewed-by: Bart Van Assche <bvanassche@....org>
> 

thanks!

> 
> 
> .
>