lkml.org 
[lkml]   [2022]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 0976/1157] s390/zcore: fix race when reading from hardware system area
    Date
    From: Alexander Gordeev <agordeev@linux.ibm.com>

    [ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ]

    Memory buffer used for reading out data from hardware system
    area is not protected against concurrent access.

    Reported-by: Matthew Wilcox <willy@infradead.org>
    Fixes: 411ed3225733 ("[S390] zfcpdump support.")
    Acked-by: Heiko Carstens <hca@linux.ibm.com>
    Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
    Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.com
    Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/s390/char/zcore.c | 11 ++++++++++-
    1 file changed, 10 insertions(+), 1 deletion(-)

    diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
    index 516783ba950f..92b32ce645b9 100644
    --- a/drivers/s390/char/zcore.c
    +++ b/drivers/s390/char/zcore.c
    @@ -50,6 +50,7 @@ static struct dentry *zcore_reipl_file;
    static struct dentry *zcore_hsa_file;
    static struct ipl_parameter_block *zcore_ipl_block;

    +static DEFINE_MUTEX(hsa_buf_mutex);
    static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);

    /*
    @@ -66,19 +67,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
    if (!hsa_available)
    return -ENODATA;

    + mutex_lock(&hsa_buf_mutex);
    while (count) {
    if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
    TRACE("sclp_sdias_copy() failed\n");
    + mutex_unlock(&hsa_buf_mutex);
    return -EIO;
    }
    offset = src % PAGE_SIZE;
    bytes = min(PAGE_SIZE - offset, count);
    - if (copy_to_user(dest, hsa_buf + offset, bytes))
    + if (copy_to_user(dest, hsa_buf + offset, bytes)) {
    + mutex_unlock(&hsa_buf_mutex);
    return -EFAULT;
    + }
    src += bytes;
    dest += bytes;
    count -= bytes;
    }
    + mutex_unlock(&hsa_buf_mutex);
    return 0;
    }

    @@ -96,9 +102,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
    if (!hsa_available)
    return -ENODATA;

    + mutex_lock(&hsa_buf_mutex);
    while (count) {
    if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
    TRACE("sclp_sdias_copy() failed\n");
    + mutex_unlock(&hsa_buf_mutex);
    return -EIO;
    }
    offset = src % PAGE_SIZE;
    @@ -108,6 +116,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
    dest += bytes;
    count -= bytes;
    }
    + mutex_unlock(&hsa_buf_mutex);
    return 0;
    }

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-16 06:53    [W:4.062 / U:0.960 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site