Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb7c5433 authored by Brian King's avatar Brian King Committed by James Bottomley
Browse files

ipr: Fix incorrect trace indexing 



When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not belong to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.

Cc: <stable@vger.kernel.org>
Tested-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: default avatarWen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: default avatarGabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent 36b8e180

drivers/scsi/ipr.c

+3 −2
Original line number Diff line number Diff line
@@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd, 
{

	struct ipr_trace_entry *trace_entry;

	struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;

	unsigned int trace_index;



	trace_entry = &ioa_cfg->trace[atomic_add_return

			(1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];

	trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;

	trace_entry = &ioa_cfg->trace[trace_index];

	trace_entry->time = jiffies;

	trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];

	trace_entry->type = type;

drivers/scsi/ipr.h

+1 −0
Original line number Diff line number Diff line
@@ -1486,6 +1486,7 @@ struct ipr_ioa_cfg { 


#define IPR_NUM_TRACE_INDEX_BITS	8

#define IPR_NUM_TRACE_ENTRIES		(1 << IPR_NUM_TRACE_INDEX_BITS)

#define IPR_TRACE_INDEX_MASK		(IPR_NUM_TRACE_ENTRIES - 1)

#define IPR_TRACE_SIZE	(sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)

	char trace_start[8];

#define IPR_TRACE_START_LABEL			"trace"