Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
1 年多 前同步成功

通知 161
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 18 12月, 2019 2 次提交
  3. 05 12月, 2019 1 次提交
  5. 19 6月, 2019 1 次提交
  7. 10 5月, 2019 1 次提交
    • S
      scsi: lpfc: change snprintf to scnprintf for possible overflow · 7a793ca1
      由 Silvio Cesare 提交于 
      commit e7f7b6f38a44697428f5a2e7c606de028df2b0e3 upstream.

Change snprintf to scnprintf. There are generally two cases where using
snprintf causes problems.

1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the
buffer size (SIZE) is, then size will end up larger than SIZE. In later
uses of snprintf, SIZE - size will result in a negative number, leading
to problems. Note that size might already be too large by using
size = snprintf before the code reaches a case of size += snprintf.

2) If size is ultimately used as a length parameter for a copy back to user
space, then it will potentially allow for a buffer overflow and information
disclosure when size is greater than SIZE. When the size is used to index
the buffer directly, we can have memory corruption. This also means when
size = snprintf... is used, it may also cause problems since size may become
large.  Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
configuration.

The solution to these issues is to use scnprintf which returns the number of
characters actually written to the buffer, so the size variable will never
exceed SIZE.
Signed-off-by: NSilvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: NWilly Tarreau <w@1wt.eu>
Signed-off-by: NJames Smart <james.smart@broadcom.com>
Cc: Dick Kennedy <dick.kennedy@broadcom.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a793ca1
  9. 21 9月, 2018 1 次提交
  11. 28 8月, 2018 1 次提交
  13. 03 8月, 2018 2 次提交
  15. 11 7月, 2018 2 次提交
  17. 27 6月, 2018 1 次提交
  19. 29 5月, 2018 1 次提交
  21. 08 5月, 2018 2 次提交
  23. 19 4月, 2018 4 次提交
  25. 13 3月, 2018 1 次提交
  27. 23 2月, 2018 3 次提交
  29. 13 2月, 2018 4 次提交
  31. 09 1月, 2018 3 次提交
  33. 04 1月, 2018 1 次提交
  35. 21 12月, 2017 2 次提交
  37. 05 12月, 2017 2 次提交
    • J
      scsi: lpfc: small sg cnt cleanup · 81e6a637
      由 James Smart 提交于 
      The logic for sg_seg_cnt is a bit convoluted. This patch tries to clean
up a couple of areas, especially around the +2 and +1 logic.

This patch:

- Cleans up the lpfc_sg_seg_cnt attribute to specify a real minimum
  rather than making the minimum be whatever the default is.

- Removes the hardcoding of +2 (for the number of elements we use in a
  sgl for cmd iu and rsp iu) and +1 (an additional entry to compensate
  for nvme's reduction of io size based on a possible partial page)
  logic in sg list initialization. In the case where the +1 logic is
  referenced in host and target io checks, use the values set in the
  transport template as that value was properly set.

There can certainly be more done in this area and it will be addressed
in combined host/target driver effort.
Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: NJames Smart <james.smart@broadcom.com>
Reviewed-by: NHannes Reinecke <hare@suse.com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      81e6a637
    • J
      scsi: lpfc: Adjust default value of lpfc_nvmet_mrq · bcb24f65
      由 James Smart 提交于 
      The current default for async hw receive queues is 1, which presents
issues under heavy load as number of queues influence the available
async receive buffer limits.

Raise the default to the either the current hw limit (16) or the number
of hw qs configured (io channel value).

Revise the attribute definition for mrq to better reflect what we do for
hw queues. E.g. 0 means default to optimal (# of cpus), non-zero
specifies a specific limit. Before this change, mrq=0 meant target mode
was disabled. As 0 now has a different meaning, rework the if tests to
use the better nvmet_support check.
Signed-off-by: NDick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: NJames Smart <james.smart@broadcom.com>
Reviewed-by: NHannes Reinecke <hare@suse.com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      bcb24f65
  39. 11 11月, 2017 1 次提交
  41. 03 10月, 2017 2 次提交
  43. 25 8月, 2017 2 次提交