From patchwork Tue Jul 14 16:41:31 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brian King X-Patchwork-Id: 6788121 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6C3259F2F0 for ; Tue, 14 Jul 2015 16:41:40 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 898412061E for ; Tue, 14 Jul 2015 16:41:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 079CF20629 for ; Tue, 14 Jul 2015 16:41:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752666AbbGNQlh (ORCPT ); Tue, 14 Jul 2015 12:41:37 -0400 Received: from e39.co.us.ibm.com ([32.97.110.160]:40117 "EHLO e39.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752653AbbGNQlg (ORCPT ); Tue, 14 Jul 2015 12:41:36 -0400 Received: from /spool/local by e39.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 14 Jul 2015 10:41:35 -0600 Received: from d03dlp03.boulder.ibm.com (9.17.202.179) by e39.co.us.ibm.com (192.168.1.139) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 14 Jul 2015 10:41:33 -0600 X-Helo: d03dlp03.boulder.ibm.com X-MailFrom: brking@linux.vnet.ibm.com X-RcptTo: stable@vger.kernel.org Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id F209819D8040; Tue, 14 Jul 2015 10:32:32 -0600 (MDT) Received: from d03av03.boulder.ibm.com (d03av03.boulder.ibm.com [9.17.195.169]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t6EGekUq57082070; Tue, 14 Jul 2015 09:40:46 -0700 Received: from d03av03.boulder.ibm.com (localhost [127.0.0.1]) by d03av03.boulder.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t6EGfWN8005760; Tue, 14 Jul 2015 10:41:33 -0600 Received: from localhost.localdomain (sig-9-65-0-125.ibm.com [9.65.0.125]) by d03av03.boulder.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id t6EGfWxP005714; Tue, 14 Jul 2015 10:41:32 -0600 Message-Id: <201507141641.t6EGfWxP005714@d03av03.boulder.ibm.com> Subject: [PATCH 2/3] [RESEND] ipr: Fix incorrect trace indexing To: James.Bottomley@HansenPartnership.com Cc: linux-scsi@vger.kernel.org, brking@linux.vnet.ibm.com, stable@vger.kernel.org, krisman@linux.vnet.ibm.com, wenxiong@linux.vnet.ibm.com From: Brian King Date: Tue, 14 Jul 2015 11:41:31 -0500 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 15071416-0033-0000-0000-00000526C8F1 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When ipr's internal driver trace was changed to an atomic, a signed/unsigned bug slipped in which results in us indexing backwards in our memory buffer writing on memory that does not belong to us. This patch fixes this by removing the modulo and instead just mask off the low bits. Cc: Tested-by: Wen Xiong Reviewed-by: Wen Xiong Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Brian King Reviewed-by: Martin K. Petersen --- drivers/scsi/ipr.c | 5 +++-- drivers/scsi/ipr.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff -puN drivers/scsi/ipr.h~ipr_trace_index_fix drivers/scsi/ipr.h --- linux/drivers/scsi/ipr.h~ipr_trace_index_fix 2015-07-14 11:12:29.898655454 -0500 +++ linux-bjking1/drivers/scsi/ipr.h 2015-07-14 11:12:29.908655404 -0500 @@ -1486,6 +1486,7 @@ struct ipr_ioa_cfg { #define IPR_NUM_TRACE_INDEX_BITS 8 #define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS) +#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1) #define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES) char trace_start[8]; #define IPR_TRACE_START_LABEL "trace" diff -puN drivers/scsi/ipr.c~ipr_trace_index_fix drivers/scsi/ipr.c --- linux/drivers/scsi/ipr.c~ipr_trace_index_fix 2015-07-14 11:12:29.903655429 -0500 +++ linux-bjking1/drivers/scsi/ipr.c 2015-07-14 11:21:31.112799218 -0500 @@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd { struct ipr_trace_entry *trace_entry; struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; + unsigned int trace_index; - trace_entry = &ioa_cfg->trace[atomic_add_return - (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES]; + trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK; + trace_entry = &ioa_cfg->trace[trace_index]; trace_entry->time = jiffies; trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0]; trace_entry->type = type;