linux-kernel - Re: [PATCH] scsi: sd_zbc: Limit the report zones buffer size to UIO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <8454a55d-bfcc-441a-837e-157123e881fe@kernel.org>
Date: Sat, 19 Apr 2025 06:29:19 +0900
From: Damien Le Moal <dlemoal@...nel.org>
To: SSiwinski@...o.com, Christoph Hellwig <hch@...radead.org>
Cc: bgrove@...o.com, James.Bottomley@...senpartnership.com,
 linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
 martin.petersen@...cle.com, Steve Siwinski <stevensiwinski@...il.com>
Subject: Re: [PATCH] scsi: sd_zbc: Limit the report zones buffer size to
 UIO_MAXIOV

On 4/19/25 05:46, SSiwinski@...o.com wrote:
> 
> "Christoph Hellwig" <hch@...radead.org> wrote on 04/14/2025 01:52:31 AM:
> 
>> On Fri, Apr 11, 2025 at 04:36:00PM -0400, Steve Siwinski wrote:
>>> The report zones buffer size is currently limited by the HBA's
>>> maximum segment count to ensure the buffer can be mapped. However,
>>> the user-space SG_IO interface further limits the number of iovec
>>> entries to UIO_MAXIOV when allocating a bio.
>>
>> Why does the userspace SG_IO interface matter here?
>> sd_zbc_alloc_report_buffer is only used for the in-kernel
>> ->report_zones call.
> 
> I was referring to the userspace SG_IO limitation (UIO_MAXIOV) in
> bio_kmalloc(), which gets called when the report zones command is
> executed and the buffer mapped in bio_map_kern().
> 
> Perhaps my wording here was poor and this is really a limitation of bio?

sd_zbc_alloc_report_buffer() is called only from sd_zbc_report_zones() which is
the disk ->report_zones() operations, which is NOT called for passthrough
commands. So modifying sd_zbc_alloc_report_buffer() will not help in any way
solving your issue with an SG_IO passthrough report zones command issued by the
user.

For reference, libzbc uses ioctl(SG_GET_SG_TABLESIZE) * sysconf(_SC_PAGESIZE) as
the max buffer size and allocates page aligned buffers to avoid these SG_IO
buffer mapping limitations.

-- 
Damien Le Moal
Western Digital Research