ACK: [PATCH] UBUNTU: SAUCE: scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM

[Philip Cox]

-- 
Acked-by: Philip Cox <philip.cox at canonical.com>


On Mon, 2022-12-05 at 10:50 -0700, Tim Gardner wrote:
> From: Michael Kelley <mikelley at microsoft.com>
> 
> https://lore.kernel.org/lkml/1670183564-76254-1-git-send-email-mikelley@microsoft.com/
> 
> storvsc_queuecommand() maps the scatter/gather list using
> scsi_dma_map(),
> which in a confidential VM allocates swiotlb bounce buffers. If the
> I/O submission fails in storvsc_do_io(), the I/O is typically retried
> by higher level code, but the bounce buffer memory is never freed.
> The mostly like cause of I/O submission failure is a full VMBus
> channel ring buffer, which is not uncommon under high I/O loads.
> Eventually enough bounce buffer memory leaks that the confidential
> VM can't do any I/O. The same problem can arise in a non-confidential
> VM with kernel boot parameter swiotlb=force.
> 
> Fix this by doing scsi_dma_unmap() in the case of an I/O submission
> error, which frees the bounce buffer memory.
> 
> Fixes: 743b237c3a7b ("scsi: storvsc: Add Isolation VM support for
> storvsc driver")
> Signed-off-by: Michael Kelley <mikelley at microsoft.com>
> ---
>  drivers/scsi/storvsc_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> index 302a29a8fd90..e817af18846e 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1887,6 +1887,9 @@ static int storvsc_queuecommand(struct
> Scsi_Host *host, struct scsi_cmnd *scmnd)
>         ret = storvsc_do_io(dev, cmd_request, get_cpu());
>         put_cpu();
>  
> +       if (ret)
> +               scsi_dma_unmap(scmnd);
> +
>         if (ret == -EAGAIN) {
>                 /* no more space */
>                 ret = SCSI_MLQUEUE_DEVICE_BUSY;
> -- 
> 2.34.1
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20221205/6e28f255/attachment.html>