Revision c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b authored by Bart Van Assche on 21 May 2018, 18:17:29 UTC, committed by Martin K. Petersen on 29 May 2018, 01:23:38 UTC
Since an SRP remote port is attached as a child to shost->shost_gendev and as the only child, the translation from the shost pointer into an rport pointer must happen by looking up the shost child that is an rport. This patch fixes the following KASAN complaint: BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp] Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19 CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1 Workqueue: kblockd blk_mq_timeout_work Call Trace: dump_stack+0x85/0xc7 print_address_description+0x65/0x270 kasan_report+0x231/0x350 srp_timed_out+0x57/0x110 [scsi_transport_srp] scsi_times_out+0xc7/0x3f0 [scsi_mod] blk_mq_terminate_expired+0xc2/0x140 bt_iter+0xbc/0xd0 blk_mq_queue_tag_busy_iter+0x1c7/0x350 blk_mq_timeout_work+0x325/0x3f0 process_one_work+0x441/0xa50 worker_thread+0x76/0x6c0 kthread+0x1b2/0x1d0 ret_from_fork+0x24/0x30 Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time") Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> Cc: Hannes Reinecke <hare@suse.com> Cc: Johannes Thumshirn <jthumshirn@suse.de> Cc: Jason Gunthorpe <jgg@mellanox.com> Cc: Doug Ledford <dledford@redhat.com> Cc: Laurence Oberman <loberman@redhat.com> Cc: stable@vger.kernel.org Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent a45b599
branch.c
#include "perf.h"
#include "util/util.h"
#include "util/debug.h"
#include "util/branch.h"
static bool cross_area(u64 addr1, u64 addr2, int size)
{
u64 align1, align2;
align1 = addr1 & ~(size - 1);
align2 = addr2 & ~(size - 1);
return (align1 != align2) ? true : false;
}
#define AREA_4K 4096
#define AREA_2M (2 * 1024 * 1024)
void branch_type_count(struct branch_type_stat *st, struct branch_flags *flags,
u64 from, u64 to)
{
if (flags->type == PERF_BR_UNKNOWN || from == 0)
return;
st->counts[flags->type]++;
if (flags->type == PERF_BR_COND) {
if (to > from)
st->cond_fwd++;
else
st->cond_bwd++;
}
if (cross_area(from, to, AREA_2M))
st->cross_2m++;
else if (cross_area(from, to, AREA_4K))
st->cross_4k++;
}
const char *branch_type_name(int type)
{
const char *branch_names[PERF_BR_MAX] = {
"N/A",
"COND",
"UNCOND",
"IND",
"CALL",
"IND_CALL",
"RET",
"SYSCALL",
"SYSRET",
"COND_CALL",
"COND_RET"
};
if (type >= 0 && type < PERF_BR_MAX)
return branch_names[type];
return NULL;
}
void branch_type_stat_display(FILE *fp, struct branch_type_stat *st)
{
u64 total = 0;
int i;
for (i = 0; i < PERF_BR_MAX; i++)
total += st->counts[i];
if (total == 0)
return;
fprintf(fp, "\n#");
fprintf(fp, "\n# Branch Statistics:");
fprintf(fp, "\n#");
if (st->cond_fwd > 0) {
fprintf(fp, "\n%8s: %5.1f%%",
"COND_FWD",
100.0 * (double)st->cond_fwd / (double)total);
}
if (st->cond_bwd > 0) {
fprintf(fp, "\n%8s: %5.1f%%",
"COND_BWD",
100.0 * (double)st->cond_bwd / (double)total);
}
if (st->cross_4k > 0) {
fprintf(fp, "\n%8s: %5.1f%%",
"CROSS_4K",
100.0 * (double)st->cross_4k / (double)total);
}
if (st->cross_2m > 0) {
fprintf(fp, "\n%8s: %5.1f%%",
"CROSS_2M",
100.0 * (double)st->cross_2m / (double)total);
}
for (i = 0; i < PERF_BR_MAX; i++) {
if (st->counts[i] > 0)
fprintf(fp, "\n%8s: %5.1f%%",
branch_type_name(i),
100.0 *
(double)st->counts[i] / (double)total);
}
}
static int count_str_scnprintf(int idx, const char *str, char *bf, int size)
{
return scnprintf(bf, size, "%s%s", (idx) ? " " : " (", str);
}
int branch_type_str(struct branch_type_stat *st, char *bf, int size)
{
int i, j = 0, printed = 0;
u64 total = 0;
for (i = 0; i < PERF_BR_MAX; i++)
total += st->counts[i];
if (total == 0)
return 0;
if (st->cond_fwd > 0)
printed += count_str_scnprintf(j++, "COND_FWD", bf + printed, size - printed);
if (st->cond_bwd > 0)
printed += count_str_scnprintf(j++, "COND_BWD", bf + printed, size - printed);
for (i = 0; i < PERF_BR_MAX; i++) {
if (i == PERF_BR_COND)
continue;
if (st->counts[i] > 0)
printed += count_str_scnprintf(j++, branch_type_name(i), bf + printed, size - printed);
}
if (st->cross_4k > 0)
printed += count_str_scnprintf(j++, "CROSS_4K", bf + printed, size - printed);
if (st->cross_2m > 0)
printed += count_str_scnprintf(j++, "CROSS_2M", bf + printed, size - printed);
return printed;
}
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...