Patch "scsi: storvsc: Don't pass unused PFNs to Hyper-V host" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    scsi: storvsc: Don't pass unused PFNs to Hyper-V host

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-storvsc-don-t-pass-unused-pfns-to-hyper-v-host.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 958775351ba84f81081ff2c2e6a6b3359f4b521a
Author: Michael Kelley <mikelley@xxxxxxxxxxxxx>
Date:   Mon May 15 10:20:41 2023 -0700

    scsi: storvsc: Don't pass unused PFNs to Hyper-V host
    
    [ Upstream commit 4e81a6cba517cb33584308a331f14f5e3fec369b ]
    
    In a SCSI request, storvsc pre-allocates space for up to
    MAX_PAGE_BUFFER_COUNT physical frame numbers to be passed to Hyper-V.  If
    the size of the I/O request requires more PFNs, a separate memory area of
    exactly the correct size is dynamically allocated.
    
    But when the pre-allocated area is used, current code always passes
    MAX_PAGE_BUFFER_COUNT PFNs to Hyper-V, even if fewer are needed.  While
    this doesn't break anything because the additional PFNs are always zero,
    more bytes than necessary are copied into the VMBus channel ring buffer.
    This takes CPU cycles and wastes space in the ring buffer. For a typical 4
    Kbyte I/O that requires only a single PFN, 248 unnecessary bytes are
    copied.
    
    Fix this by setting the payload_sz based on the actual number of PFNs
    required, not the size of the pre-allocated space.
    
    Reported-by: John Starks <jostarks@xxxxxxxxxxxxx>
    Fixes: 8f43710543ef ("scsi: storvsc: Support PAGE_SIZE larger than 4K")
    Signed-off-by: Michael Kelley <mikelley@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/1684171241-16209-1-git-send-email-mikelley@xxxxxxxxxxxxx
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 83a3d9f085d84..c9b1500c2ab87 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1843,7 +1843,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
 
 	length = scsi_bufflen(scmnd);
 	payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
-	payload_sz = sizeof(cmd_request->mpb);
+	payload_sz = 0;
 
 	if (sg_count) {
 		unsigned int hvpgoff, hvpfns_to_add;
@@ -1851,10 +1851,10 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
 		unsigned int hvpg_count = HVPFN_UP(offset_in_hvpg + length);
 		u64 hvpfn;
 
-		if (hvpg_count > MAX_PAGE_BUFFER_COUNT) {
+		payload_sz = (hvpg_count * sizeof(u64) +
+			      sizeof(struct vmbus_packet_mpb_array));
 
-			payload_sz = (hvpg_count * sizeof(u64) +
-				      sizeof(struct vmbus_packet_mpb_array));
+		if (hvpg_count > MAX_PAGE_BUFFER_COUNT) {
 			payload = kzalloc(payload_sz, GFP_ATOMIC);
 			if (!payload)
 				return SCSI_MLQUEUE_DEVICE_BUSY;