lkml.org 
[lkml]   [2017]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 016/306] zfcp: fix payload trace length for SAN request&response
    3.16.40-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Steffen Maier <maier@linux.vnet.ibm.com>

    commit 94db3725f049ead24c96226df4a4fb375b880a77 upstream.

    commit 2c55b750a884b86dea8b4cc5f15e1484cc47a25c
    ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.")
    started to add FC_CT_HDR_LEN which made zfcp dump random data
    out of bounds for RSPN GS responses because u.rspn.rsp
    is the largest and last field in the union of struct zfcp_fc_req.
    Other request/response types only happened to stay within bounds
    due to the padding of the union or
    due to the trace capping of u.gspn.rsp to ZFCP_DBF_SAN_MAX_PAYLOAD.

    Timestamp : ...
    Area : SAN
    Subarea : 00
    Level : 1
    Exception : -
    CPU id : ..
    Caller : ...
    Record id : 2
    Tag : fsscth2
    Request id : 0x...
    Destination ID : 0x00fffffc
    Payload short : 01000000 fc020000 80020000 00000000
    xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx <===
    00000000 00000000 00000000 00000000
    Payload length : 32 <===

    struct zfcp_fc_req {
    [0] struct zfcp_fsf_ct_els ct_els;
    [56] struct scatterlist sg_req;
    [96] struct scatterlist sg_rsp;
    union {
    struct {req; rsp;} adisc; SIZE: 28+28= 56
    struct {req; rsp;} gid_pn; SIZE: 24+20= 44
    struct {rspsg; req;} gpn_ft; SIZE: 40*4+20=180
    struct {req; rsp;} gspn; SIZE: 20+273= 293
    struct {req; rsp;} rspn; SIZE: 277+16= 293
    [136] } u;
    }
    SIZE: 432

    Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
    Fixes: 2c55b750a884 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.")
    Reviewed-by: Alexey Ishchuk <aishchuk@linux.vnet.ibm.com>
    Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
    Reviewed-by: Hannes Reinecke <hare@suse.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/s390/scsi/zfcp_dbf.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/s390/scsi/zfcp_dbf.c
    +++ b/drivers/s390/scsi/zfcp_dbf.c
    @@ -389,7 +389,7 @@ void zfcp_dbf_san_req(char *tag, struct
    struct zfcp_fsf_ct_els *ct_els = fsf->data;
    u16 length;

    - length = (u16)(ct_els->req->length + FC_CT_HDR_LEN);
    + length = (u16)(ct_els->req->length);
    zfcp_dbf_san(tag, dbf, sg_virt(ct_els->req), ZFCP_DBF_SAN_REQ, length,
    fsf->req_id, d_id);
    }
    @@ -405,7 +405,7 @@ void zfcp_dbf_san_res(char *tag, struct
    struct zfcp_fsf_ct_els *ct_els = fsf->data;
    u16 length;

    - length = (u16)(ct_els->resp->length + FC_CT_HDR_LEN);
    + length = (u16)(ct_els->resp->length);
    zfcp_dbf_san(tag, dbf, sg_virt(ct_els->resp), ZFCP_DBF_SAN_RES, length,
    fsf->req_id, ct_els->d_id);
    }
    \
     
     \ /
      Last update: 2017-02-16 00:57    [W:3.348 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site