All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/1] ipr: Fix incorrect trace indexing
@ 2015-06-22 22:33 ` Brian King
  0 siblings, 0 replies; 4+ messages in thread
From: Brian King @ 2015-06-22 22:33 UTC (permalink / raw)
  To: James.Bottomley; +Cc: linux-scsi, wenxiong, krisman, brking, stable


James,

One more ipr patch to go on top of my previous series I sent. This one fixes
a pretty nasty bug that can cause us to go writing in memory that is not ours.

8<

When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not below to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.

Cc: <stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---

 drivers/scsi/ipr.c |    5 +++--
 drivers/scsi/ipr.h |    1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff -puN drivers/scsi/ipr.h~ipr_trace_index_fix drivers/scsi/ipr.h
--- linux/drivers/scsi/ipr.h~ipr_trace_index_fix	2015-06-22 16:52:15.649018937 -0500
+++ linux-bjking1/drivers/scsi/ipr.h	2015-06-22 16:52:31.895895037 -0500
@@ -1487,6 +1487,7 @@ struct ipr_ioa_cfg {
 
 #define IPR_NUM_TRACE_INDEX_BITS	8
 #define IPR_NUM_TRACE_ENTRIES		(1 << IPR_NUM_TRACE_INDEX_BITS)
+#define IPR_TRACE_INDEX_MASK		(IPR_NUM_TRACE_ENTRIES - 1)
 #define IPR_TRACE_SIZE	(sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
 	char trace_start[8];
 #define IPR_TRACE_START_LABEL			"trace"
diff -puN drivers/scsi/ipr.c~ipr_trace_index_fix drivers/scsi/ipr.c
--- linux/drivers/scsi/ipr.c~ipr_trace_index_fix	2015-06-22 16:52:17.800002537 -0500
+++ linux-bjking1/drivers/scsi/ipr.c	2015-06-22 16:53:17.327548285 -0500
@@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd
 {
 	struct ipr_trace_entry *trace_entry;
 	struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+	unsigned int trace_index;
 
-	trace_entry = &ioa_cfg->trace[atomic_add_return
-			(1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
+	trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
+	trace_entry = &ioa_cfg->trace[trace_index];
 	trace_entry->time = jiffies;
 	trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
 	trace_entry->type = type;
_

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [PATCH 1/1] ipr: Fix incorrect trace indexing
@ 2015-06-22 22:33 ` Brian King
  0 siblings, 0 replies; 4+ messages in thread
From: Brian King @ 2015-06-22 22:33 UTC (permalink / raw)
  To: James.Bottomley; +Cc: linux-scsi, wenxiong, krisman, brking, stable


James,

One more ipr patch to go on top of my previous series I sent. This one fixes
a pretty nasty bug that can cause us to go writing in memory that is not ours.

8<

When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not below to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.

Cc: <stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---

 drivers/scsi/ipr.c |    5 +++--
 drivers/scsi/ipr.h |    1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff -puN drivers/scsi/ipr.h~ipr_trace_index_fix drivers/scsi/ipr.h
--- linux/drivers/scsi/ipr.h~ipr_trace_index_fix	2015-06-22 16:52:15.649018937 -0500
+++ linux-bjking1/drivers/scsi/ipr.h	2015-06-22 16:52:31.895895037 -0500
@@ -1487,6 +1487,7 @@ struct ipr_ioa_cfg {
 
 #define IPR_NUM_TRACE_INDEX_BITS	8
 #define IPR_NUM_TRACE_ENTRIES		(1 << IPR_NUM_TRACE_INDEX_BITS)
+#define IPR_TRACE_INDEX_MASK		(IPR_NUM_TRACE_ENTRIES - 1)
 #define IPR_TRACE_SIZE	(sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
 	char trace_start[8];
 #define IPR_TRACE_START_LABEL			"trace"
diff -puN drivers/scsi/ipr.c~ipr_trace_index_fix drivers/scsi/ipr.c
--- linux/drivers/scsi/ipr.c~ipr_trace_index_fix	2015-06-22 16:52:17.800002537 -0500
+++ linux-bjking1/drivers/scsi/ipr.c	2015-06-22 16:53:17.327548285 -0500
@@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd
 {
 	struct ipr_trace_entry *trace_entry;
 	struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+	unsigned int trace_index;
 
-	trace_entry = &ioa_cfg->trace[atomic_add_return
-			(1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
+	trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
+	trace_entry = &ioa_cfg->trace[trace_index];
 	trace_entry->time = jiffies;
 	trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
 	trace_entry->type = type;
_

--
To unsubscribe from this list: send the line "unsubscribe stable" in

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] ipr: Fix incorrect trace indexing
  2015-06-22 22:33 ` Brian King
  (?)
@ 2015-07-10 18:46 ` wenxiong
  -1 siblings, 0 replies; 4+ messages in thread
From: wenxiong @ 2015-07-10 18:46 UTC (permalink / raw)
  To: Brian King; +Cc: James.Bottomley, linux-scsi, krisman, stable


Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>

Thanks,
Wendy

>> Quoting Brian King <brking@linux.vnet.ibm.com>:

> James,
>
> One more ipr patch to go on top of my previous series I sent. This one fixes
> a pretty nasty bug that can cause us to go writing in memory that is  
> not ours.
>
> 8<
>
> When ipr's internal driver trace was changed to an atomic, a signed/unsigned
> bug slipped in which results in us indexing backwards in our memory buffer
> writing on memory that does not below to us. This patch fixes this  
> by removing
> the modulo and instead just mask off the low bits.
>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
> ---
>
>  drivers/scsi/ipr.c |    5 +++--
>  drivers/scsi/ipr.h |    1 +
>  2 files changed, 4 insertions(+), 2 deletions(-)
>
> diff -puN drivers/scsi/ipr.h~ipr_trace_index_fix drivers/scsi/ipr.h
> --- linux/drivers/scsi/ipr.h~ipr_trace_index_fix	2015-06-22  
> 16:52:15.649018937 -0500
> +++ linux-bjking1/drivers/scsi/ipr.h	2015-06-22 16:52:31.895895037 -0500
> @@ -1487,6 +1487,7 @@ struct ipr_ioa_cfg {
>
>  #define IPR_NUM_TRACE_INDEX_BITS	8
>  #define IPR_NUM_TRACE_ENTRIES		(1 << IPR_NUM_TRACE_INDEX_BITS)
> +#define IPR_TRACE_INDEX_MASK		(IPR_NUM_TRACE_ENTRIES - 1)
>  #define IPR_TRACE_SIZE	(sizeof(struct ipr_trace_entry) *  
> IPR_NUM_TRACE_ENTRIES)
>  	char trace_start[8];
>  #define IPR_TRACE_START_LABEL			"trace"
> diff -puN drivers/scsi/ipr.c~ipr_trace_index_fix drivers/scsi/ipr.c
> --- linux/drivers/scsi/ipr.c~ipr_trace_index_fix	2015-06-22  
> 16:52:17.800002537 -0500
> +++ linux-bjking1/drivers/scsi/ipr.c	2015-06-22 16:53:17.327548285 -0500
> @@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd
>  {
>  	struct ipr_trace_entry *trace_entry;
>  	struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
> +	unsigned int trace_index;
>
> -	trace_entry = &ioa_cfg->trace[atomic_add_return
> -			(1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
> +	trace_index = atomic_add_return(1, &ioa_cfg->trace_index) &  
> IPR_TRACE_INDEX_MASK;
> +	trace_entry = &ioa_cfg->trace[trace_index];
>  	trace_entry->time = jiffies;
>  	trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
>  	trace_entry->type = type;
> _

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] ipr: Fix incorrect trace indexing
  2015-06-22 22:33 ` Brian King
  (?)
  (?)
@ 2015-07-10 19:19 ` Gabriel Krisman Bertazi
  -1 siblings, 0 replies; 4+ messages in thread
From: Gabriel Krisman Bertazi @ 2015-07-10 19:19 UTC (permalink / raw)
  To: Brian King; +Cc: James.Bottomley, linux-scsi, wenxiong, stable

Brian King <brking@linux.vnet.ibm.com> writes:

> One more ipr patch to go on top of my previous series I sent. This one fixes
> a pretty nasty bug that can cause us to go writing in memory that is not ours.
>

Please add:

Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>

Thanks,

-- 
Gabriel Krisman Bertazi

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-07-10 19:19 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-22 22:33 [PATCH 1/1] ipr: Fix incorrect trace indexing Brian King
2015-06-22 22:33 ` Brian King
2015-07-10 18:46 ` wenxiong
2015-07-10 19:19 ` Gabriel Krisman Bertazi

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.