Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3edcd134 authored by Alexander Gordeev's avatar Alexander Gordeev Committed by Greg Kroah-Hartman
Browse files

s390/zcore: fix race when reading from hardware system area 



[ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ]

Memory buffer used for reading out data from hardware system
area is not protected against concurrent access.

Reported-by: default avatarMatthew Wilcox <willy@infradead.org>
Fixes: 411ed322 ("[S390] zfcpdump support.")
Acked-by: default avatarHeiko Carstens <hca@linux.ibm.com>
Tested-by: default avatarAlexander Egorenkov <egorenar@linux.ibm.com>
Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.com


Signed-off-by: default avatarAlexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 50be644f

drivers/s390/char/zcore.c

+10 −1
Original line number Diff line number Diff line
@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; 
static struct dentry *zcore_hsa_file;

static struct ipl_parameter_block *zcore_ipl_block;



static DEFINE_MUTEX(hsa_buf_mutex);

static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);



/*
@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count) 
	if (!hsa_available)

		return -ENODATA;



	mutex_lock(&hsa_buf_mutex);

	while (count) {

		if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {

			TRACE("sclp_sdias_copy() failed\n");

			mutex_unlock(&hsa_buf_mutex);

			return -EIO;

		}

		offset = src % PAGE_SIZE;

		bytes = min(PAGE_SIZE - offset, count);

		if (copy_to_user(dest, hsa_buf + offset, bytes))

		if (copy_to_user(dest, hsa_buf + offset, bytes)) {

			mutex_unlock(&hsa_buf_mutex);

			return -EFAULT;

		}

		src += bytes;

		dest += bytes;

		count -= bytes;

	}

	mutex_unlock(&hsa_buf_mutex);

	return 0;

}
@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) 
	if (!hsa_available)

		return -ENODATA;



	mutex_lock(&hsa_buf_mutex);

	while (count) {

		if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {

			TRACE("sclp_sdias_copy() failed\n");

			mutex_unlock(&hsa_buf_mutex);

			return -EIO;

		}

		offset = src % PAGE_SIZE;
@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) 
		dest += bytes;

		count -= bytes;

	}

	mutex_unlock(&hsa_buf_mutex);

	return 0;

}