[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v4 9/9] scsi/scsi_bus: fix races in REPORT LUNS
From: |
Maxim Levitsky |
Subject: |
[PATCH v4 9/9] scsi/scsi_bus: fix races in REPORT LUNS |
Date: |
Mon, 31 Aug 2020 18:01:24 +0300 |
Currently scsi_target_emulate_report_luns iterates
over child devices list twice, and there is guarantee, that
it will not be changed meanwhile.
This reason for two loops is that it needs to know how much memory
to allocate.
Avoid this by iterating once, and allocating the memory for the output
dynamically with reserving enought memory so that in practice it won't
be reallocated often.
Bugzilla for reference: https://bugzilla.redhat.com/show_bug.cgi?id=1866707
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
hw/scsi/scsi-bus.c | 62 ++++++++++++++++++++++------------------------
1 file changed, 29 insertions(+), 33 deletions(-)
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index feab20b76d..150dee2e6a 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -438,19 +438,25 @@ struct SCSITargetReq {
static void store_lun(uint8_t *outbuf, int lun)
{
if (lun < 256) {
+ /* Simple logical unit addressing method*/
+ outbuf[0] = 0;
outbuf[1] = lun;
- return;
+ } else {
+ /* Flat space addressing method */
+ outbuf[0] = 0x40 | (lun >> 8);
+ outbuf[1] = (lun & 255);
}
- outbuf[1] = (lun & 255);
- outbuf[0] = (lun >> 8) | 0x40;
}
static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
{
BusChild *kid;
- int i, len, n;
int channel, id;
- bool found_lun0;
+ uint8_t tmp[8] = {0};
+ int len = 0;
+
+ /* reserve space for 63 LUNs*/
+ GByteArray *buf = g_byte_array_sized_new(512);
if (r->req.cmd.xfer < 16) {
return false;
@@ -460,46 +466,36 @@ static bool scsi_target_emulate_report_luns(SCSITargetReq
*r)
}
channel = r->req.dev->channel;
id = r->req.dev->id;
- found_lun0 = false;
- n = 0;
- rcu_read_lock();
- QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) {
- DeviceState *qdev = kid->child;
- SCSIDevice *dev = SCSI_DEVICE(qdev);
+ /* add size (will be updated later to correct value */
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
- if (dev->channel == channel && dev->id == id) {
- if (dev->lun == 0) {
- found_lun0 = true;
- }
- n += 8;
- }
- }
- if (!found_lun0) {
- n += 8;
- }
-
- scsi_target_alloc_buf(&r->req, n + 8);
+ /* add LUN0 */
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
- len = MIN(n + 8, r->req.cmd.xfer & ~7);
- memset(r->buf, 0, len);
- stl_be_p(&r->buf[0], n);
- i = found_lun0 ? 8 : 16;
+ rcu_read_lock();
QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) {
DeviceState *qdev = kid->child;
SCSIDevice *dev = SCSI_DEVICE(qdev);
- if (dev->channel == channel && dev->id == id) {
- store_lun(&r->buf[i], dev->lun);
- i += 8;
+ if (dev->channel == channel && dev->id == id && dev->lun != 0) {
+ store_lun(tmp, dev->lun);
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
}
}
-
rcu_read_unlock();
- assert(i == n + 8);
- r->len = len;
+ r->buf_len = len;
+ r->buf = g_byte_array_free(buf, FALSE);
+ r->len = MIN(len, r->req.cmd.xfer & ~7);
+
+ /* store the LUN list length */
+ stl_be_p(&r->buf[0], len - 8);
+
return true;
}
--
2.26.2
- [PATCH v4 0/9] Fix scsi devices plug/unplug races w.r.t virtio-scsi iothread, Maxim Levitsky, 2020/08/31
- [PATCH v4 1/9] scsi/scsi_bus: switch search direction in scsi_device_find, Maxim Levitsky, 2020/08/31
- [PATCH v4 2/9] rcu: Implement drain_call_rcu, Maxim Levitsky, 2020/08/31
- [PATCH v4 3/9] device_core: use drain_call_rcu in in hmp_device_del/qmp_device_add, Maxim Levitsky, 2020/08/31
- [PATCH v4 4/9] device-core: use RCU for list of childs of a bus, Maxim Levitsky, 2020/08/31
- [PATCH v4 5/9] device-core: use atomic_set on .realized property, Maxim Levitsky, 2020/08/31
- [PATCH v4 7/9] scsi/scsi_bus: Add scsi_device_get, Maxim Levitsky, 2020/08/31
- [PATCH v4 8/9] virtio-scsi: use scsi_device_get, Maxim Levitsky, 2020/08/31
- [PATCH v4 9/9] scsi/scsi_bus: fix races in REPORT LUNS,
Maxim Levitsky <=
- [PATCH v4 6/9] scsi/scsi-bus: scsi_device_find: don't return unrealized devices, Maxim Levitsky, 2020/08/31