From patchwork Tue Aug 22 05:31:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Long Li X-Patchwork-Id: 9914237 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D955160381 for ; Tue, 22 Aug 2017 05:33:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C0BD7286BC for ; Tue, 22 Aug 2017 05:33:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B57A7287DC; Tue, 22 Aug 2017 05:33:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7AB24286BC for ; Tue, 22 Aug 2017 05:33:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751310AbdHVFc6 (ORCPT ); Tue, 22 Aug 2017 01:32:58 -0400 Received: from a2nlsmtp01-03.prod.iad2.secureserver.net ([198.71.225.37]:44718 "EHLO a2nlsmtp01-03.prod.iad2.secureserver.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751274AbdHVFc4 (ORCPT ); Tue, 22 Aug 2017 01:32:56 -0400 Received: from linuxonhyperv.com ([107.180.71.197]) by : HOSTING RELAY : with SMTP id k1n9doRv9yEu9k1n9dnUL0; Mon, 21 Aug 2017 22:31:55 -0700 x-originating-ip: 107.180.71.197 Received: from longli by linuxonhyperv.com with local (Exim 4.89) (envelope-from ) id 1dk1n9-0004vQ-8Y; Mon, 21 Aug 2017 22:31:55 -0700 From: Long Li To: "K. Y. Srinivasan" , Haiyang Zhang , "James E.J. Bottomley" , devel@linuxdriverproject.org, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Long Li Subject: [PATCH] storvsc: do not assume SG list is continuous when doing bounce buffers (for 4.1 stable only) Date: Mon, 21 Aug 2017 22:31:45 -0700 Message-Id: <1503379905-18908-1-git-send-email-longli@exchange.microsoft.com> X-Mailer: git-send-email 1.7.1 X-CMAE-Envelope: MS4wfNvG3TK9GRLC9DfIYfs720buI+Vgtfg5ROKqF9lqdGnqmn8+Q0G+TLcQNNctceRKK42OI2BfG/5N/Csr5t1NFc2BL+Uxc+I6T21Z3Tr6G0gn8g9Tlwz7 nkWfpdP81bhwyqyelimvMM1UXAw+FD9WSvJY0p0ncfdjLBdkbKieO71+bgaX14hSv3BLdmHxBEFq3tx7q59ZMRFY2udxl+s1FQExobBgmQmseYVP8lMSWva8 SPP0zxbh6vSNdU2qcuZehmRelIY6tPBWDcsnkokBLu8Ci80gXKV36s/O/nFdBwQydHTBzEhen9mssM6w2V/j/Sfrffvp60K2ck+vLAHNMCHP3qWp2EeaCBJv Ql7nKDgVajkFaOvqZPPxNjm9Wl4X5QpaV3dDstXrwHVGRsVz9r8e4cK3I9QZhdl76weT/v8ly8jINV+RdV0ojIzJi6QnuA== Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Long Li This patch is for linux-stable 4.1 branch only. storvsc checks the SG list for gaps before passing them to Hyper-v device. If there are gaps, data is copied to a bounce buffer and a continuous data buffer is passed to Hyper-V. The check on gaps assumes SG list is continuous, and not chained. This is not always true. Failing the check may result in incorrect I/O data passed to the Hyper-v device. This code path is not used post Linux 4.1. Signed-off-by: Long Li Acked-by: Martin K. Petersen --- drivers/scsi/storvsc_drv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 6c52d14..14dc5c6 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -584,17 +584,18 @@ static int do_bounce_buffer(struct scatterlist *sgl, unsigned int sg_count) for (i = 0; i < sg_count; i++) { if (i == 0) { /* make sure 1st one does not have hole */ - if (sgl[i].offset + sgl[i].length != PAGE_SIZE) + if (sgl->offset + sgl->length != PAGE_SIZE) return i; } else if (i == sg_count - 1) { /* make sure last one does not have hole */ - if (sgl[i].offset != 0) + if (sgl->offset != 0) return i; } else { /* make sure no hole in the middle */ - if (sgl[i].length != PAGE_SIZE || sgl[i].offset != 0) + if (sgl->length != PAGE_SIZE || sgl->offset != 0) return i; } + sgl = sg_next(sgl); } return -1; }