From: John Garry <john.garry@huawei.com>
To: Dexuan Cui <decui@microsoft.com>, <kys@microsoft.com>,
<sthemmin@microsoft.com>, <wei.liu@kernel.org>,
<jejb@linux.ibm.com>, <martin.petersen@oracle.com>,
<haiyangz@microsoft.com>, <ming.lei@redhat.com>,
<bvanassche@acm.org>, <linux-scsi@vger.kernel.org>,
<linux-hyperv@vger.kernel.org>, <longli@microsoft.com>,
<mikelley@microsoft.com>
Cc: <linux-kernel@vger.kernel.org>, <stable@vger.kernel.org>
Subject: Re: [PATCH v2] scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
Date: Thu, 7 Oct 2021 22:41:46 +0100 [thread overview]
Message-ID: <8fe3959d-9462-64f6-53d8-ef7036ec0545@huawei.com> (raw)
In-Reply-To: <20211007174957.2080-1-decui@microsoft.com>
On 07/10/2021 18:49, Dexuan Cui wrote:
> After commit ea2f0f77538c, a 416-CPU VM running on Hyper-V hangs during
> boot because scsi_add_host_with_dma() sets shost->cmd_per_lun to a
> negative number (the below numbers may differ in different kernel versions):
> in drivers/scsi/storvsc_drv.c, storvsc_drv_init() sets
> 'max_outstanding_req_per_channel' to 352, and storvsc_probe() sets
> 'max_sub_channels' to (416 - 1) / 4 = 103 and sets scsi_driver.can_queue to
> 352 * (103 + 1) * (100 - 10) / 100 = 32947, which exceeds SHRT_MAX.
I think that you just need to mention that if can_queue exceeds
SHRT_MAX, then there is a data truncation issue.
>
> Use min_t(int, ...) to fix the issue.
>
> Fixes: ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dexuan Cui <decui@microsoft.com>
It looks ok, I'd just like to test it a bit more.
Thanks,
John
> ---
>
> v1 tried to fix the issue by changing the storvsc driver:
> https://lwn.net/ml/linux-kernel/BYAPR21MB1270BBC14D5F1AE69FC31A16BFB09@BYAPR21MB1270.namprd21.prod.outlook.com/
>
> v2 directly fixes the scsi core change instead as Michael Kelley and
> John Garry suggested (refer to the above link).
To be fair, it was Michael's suggestion
>
> drivers/scsi/hosts.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
> index 3f6f14f0cafb..24b72ee4246f 100644
> --- a/drivers/scsi/hosts.c
> +++ b/drivers/scsi/hosts.c
> @@ -220,7 +220,8 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
> goto fail;
> }
>
> - shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
> + /* Use min_t(int, ...) in case shost->can_queue exceeds SHRT_MAX */
> + shost->cmd_per_lun = min_t(int, shost->cmd_per_lun,
> shost->can_queue);
>
> error = scsi_init_sense_cache(shost);
>
next prev parent reply other threads:[~2021-10-07 21:39 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-07 17:49 [PATCH v2] scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() Dexuan Cui
2021-10-07 18:10 ` Haiyang Zhang
2021-10-07 21:41 ` John Garry [this message]
2021-10-07 22:52 ` Dexuan Cui
2021-10-08 3:19 ` Ming Lei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8fe3959d-9462-64f6-53d8-ef7036ec0545@huawei.com \
--to=john.garry@huawei.com \
--cc=bvanassche@acm.org \
--cc=decui@microsoft.com \
--cc=haiyangz@microsoft.com \
--cc=jejb@linux.ibm.com \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=longli@microsoft.com \
--cc=martin.petersen@oracle.com \
--cc=mikelley@microsoft.com \
--cc=ming.lei@redhat.com \
--cc=stable@vger.kernel.org \
--cc=sthemmin@microsoft.com \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.