1. 10 5月, 2019 1 次提交
    • S
      scsi: lpfc: change snprintf to scnprintf for possible overflow · 7a793ca1
      Silvio Cesare 提交于
      commit e7f7b6f38a44697428f5a2e7c606de028df2b0e3 upstream.
      
      Change snprintf to scnprintf. There are generally two cases where using
      snprintf causes problems.
      
      1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
      In this case, if snprintf would have written more characters than what the
      buffer size (SIZE) is, then size will end up larger than SIZE. In later
      uses of snprintf, SIZE - size will result in a negative number, leading
      to problems. Note that size might already be too large by using
      size = snprintf before the code reaches a case of size += snprintf.
      
      2) If size is ultimately used as a length parameter for a copy back to user
      space, then it will potentially allow for a buffer overflow and information
      disclosure when size is greater than SIZE. When the size is used to index
      the buffer directly, we can have memory corruption. This also means when
      size = snprintf... is used, it may also cause problems since size may become
      large.  Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
      configuration.
      
      The solution to these issues is to use scnprintf which returns the number of
      characters actually written to the buffer, so the size variable will never
      exceed SIZE.
      Signed-off-by: NSilvio Cesare <silvio.cesare@gmail.com>
      Signed-off-by: NWilly Tarreau <w@1wt.eu>
      Signed-off-by: NJames Smart <james.smart@broadcom.com>
      Cc: Dick Kennedy <dick.kennedy@broadcom.com>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Greg KH <greg@kroah.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a793ca1
  2. 21 9月, 2018 1 次提交
  3. 28 8月, 2018 1 次提交
  4. 03 8月, 2018 2 次提交
  5. 11 7月, 2018 2 次提交
  6. 27 6月, 2018 1 次提交
  7. 29 5月, 2018 1 次提交
  8. 08 5月, 2018 2 次提交
  9. 19 4月, 2018 4 次提交
  10. 13 3月, 2018 1 次提交
  11. 23 2月, 2018 3 次提交
  12. 13 2月, 2018 4 次提交
  13. 09 1月, 2018 3 次提交
  14. 04 1月, 2018 1 次提交
  15. 21 12月, 2017 2 次提交
  16. 05 12月, 2017 2 次提交
    • J
      scsi: lpfc: small sg cnt cleanup · 81e6a637
      James Smart 提交于
      The logic for sg_seg_cnt is a bit convoluted. This patch tries to clean
      up a couple of areas, especially around the +2 and +1 logic.
      
      This patch:
      
      - Cleans up the lpfc_sg_seg_cnt attribute to specify a real minimum
        rather than making the minimum be whatever the default is.
      
      - Removes the hardcoding of +2 (for the number of elements we use in a
        sgl for cmd iu and rsp iu) and +1 (an additional entry to compensate
        for nvme's reduction of io size based on a possible partial page)
        logic in sg list initialization. In the case where the +1 logic is
        referenced in host and target io checks, use the values set in the
        transport template as that value was properly set.
      
      There can certainly be more done in this area and it will be addressed
      in combined host/target driver effort.
      Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
      Signed-off-by: NJames Smart <james.smart@broadcom.com>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      81e6a637
    • J
      scsi: lpfc: Adjust default value of lpfc_nvmet_mrq · bcb24f65
      James Smart 提交于
      The current default for async hw receive queues is 1, which presents
      issues under heavy load as number of queues influence the available
      async receive buffer limits.
      
      Raise the default to the either the current hw limit (16) or the number
      of hw qs configured (io channel value).
      
      Revise the attribute definition for mrq to better reflect what we do for
      hw queues. E.g. 0 means default to optimal (# of cpus), non-zero
      specifies a specific limit. Before this change, mrq=0 meant target mode
      was disabled. As 0 now has a different meaning, rework the if tests to
      use the better nvmet_support check.
      Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
      Signed-off-by: NJames Smart <james.smart@broadcom.com>
      Reviewed-by: NHannes Reinecke <hare@suse.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      bcb24f65
  17. 11 11月, 2017 1 次提交
  18. 03 10月, 2017 2 次提交
  19. 25 8月, 2017 2 次提交
  20. 10 8月, 2017 1 次提交
    • J
      lpfc: support nvmet_fc defer_rcv callback · 50738420
      James Smart 提交于
      Currently, calls to nvmet_fc_rcv_fcp_req() always copied the
      FC-NVME cmd iu to a temporary buffer before returning, allowing
      the driver to immediately repost the buffer to the hardware.
      
      To address timing conditions on queue element structures vs async
      command reception, the nvmet_fc transport occasionally may need to
      hold on to the command iu buffer for a short period. In these cases,
      the nvmet_fc_rcv_fcp_req() will return a special return code
      (-EOVERFLOW). In these cases, the LLDD must delay until the new
      defer_rcv lldd callback is called before recycling the buffer back
      to the hw.
      
      This patch adds support for the new nvmet_fc transport defer_rcv
      callback and recognition of the new error code when passing commands
      to the transport.
      Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
      Signed-off-by: NJames Smart <james.smart@broadcom.com>
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      50738420
  21. 20 6月, 2017 2 次提交
  22. 13 6月, 2017 1 次提交
    • J
      scsi: lpfc: Add auto EQ delay logic · 0cf07f84
      James Smart 提交于
      Administrator intervention is currently required to get good numbers
      when switching from running latency tests to IOPS tests.
      
      The configured interrupt coalescing values will greatly effect the
      results of these tests.  Currently, the driver has a single coalescing
      value set by values of the module attribute.  This patch changes the
      driver to support auto-configuration of the coalescing value based on
      the total number of outstanding IOs and average number of CQEs processed
      per interrupt for an EQ.  Values are checked every 5 seconds.
      
      The driver defaults to the automatic selection. Automatic selection can
      be disabled by the new lpfc_auto_imax module_parameter.
      
      Older hardware can only change interrupt coalescing by mailbox
      command. Newer hardware supports change via a register. The patch
      support both.
      Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
      Signed-off-by: NJames Smart <james.smart@broadcom.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      0cf07f84