Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1207773

[PATCH 3.10 07/35] ipr: Fix incorrect trace indexing

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian King <brking@linux.vnet.ibm.com>

commit bb7c54339e6a10ecce5c4961adf5e75b3cf0af30 upstream.

When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not belong to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.

Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/ipr.c |    5 +++--
 drivers/scsi/ipr.h |    1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -554,9 +554,10 @@ static void ipr_trc_hook(struct ipr_cmnd
 {
 	struct ipr_trace_entry *trace_entry;
 	struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+	unsigned int trace_index;
 
-	trace_entry = &ioa_cfg->trace[atomic_add_return
-			(1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
+	trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
+	trace_entry = &ioa_cfg->trace[trace_index];
 	trace_entry->time = jiffies;
 	trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
 	trace_entry->type = type;
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1452,6 +1452,7 @@ struct ipr_ioa_cfg {
 
 #define IPR_NUM_TRACE_INDEX_BITS	8
 #define IPR_NUM_TRACE_ENTRIES		(1 << IPR_NUM_TRACE_INDEX_BITS)
+#define IPR_TRACE_INDEX_MASK		(IPR_NUM_TRACE_ENTRIES - 1)
 #define IPR_TRACE_SIZE	(sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
 	char trace_start[8];
 #define IPR_TRACE_START_LABEL			"trace"


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/35] 3.10.87-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.10 06/35] ipr: Fix locking for unit attention handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.10 07/35] ipr: Fix incorrect trace indexing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.10 29/35] ARM: 7819/1: fiq: Cast the first argument of flush_icache_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 28/35] ARM: Fix FIQ code on VIVT CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 32/35] signal: fix information leak in copy_siginfo_from_user32 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 33/35] kvm: x86: fix kvm_apic_has_events to check for NULL pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 30/35] signalfd: fix information leak in signalfd_copyinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 31/35] signal: fix information leak in copy_siginfo_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 03/35] MIPS: Make set_pte() SMP safe. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 35/35] mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  [PATCH 3.10 34/35] md/bitmap: return an error when bitmap superblock is corrupt. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:20 +0200
  Re: [PATCH 3.10 00/35] 3.10.87-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-08-15 02:20 +0200
  Re: [PATCH 3.10 00/35] 3.10.87-stable review Guenter Roeck <linux@roeck-us.net> - 2015-08-15 17:20 +0200

csiph-web