Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fde4caf6 authored by Alexander Egorenkov's avatar Alexander Egorenkov Committed by Greg Kroah-Hartman
Browse files

s390/sclp: fix Secure-IPL facility detection 



commit d76b14f3971a0638b6cd0da289f8b48acee287d0 upstream.

Prevent out-of-range access if the returned SCLP SCCB response is smaller
in size than the address of the Secure-IPL flag.

Fixes: c9896acc ("s390/ipl: Provide has_secure sysfs attribute")
Cc: stable@vger.kernel.org # 5.2+
Signed-off-by: default avatarAlexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: default avatarVasily Gorbik <gor@linux.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 15b674b1

drivers/s390/char/sclp_early.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -40,13 +40,14 @@ static void __init sclp_early_facilities_detect(struct read_info_sccb *sccb) 
	sclp.has_gisaf = !!(sccb->fac118 & 0x08);

	sclp.has_gisaf = !!(sccb->fac118 & 0x08);

	sclp.has_hvs = !!(sccb->fac119 & 0x80);

	sclp.has_hvs = !!(sccb->fac119 & 0x80);

	sclp.has_kss = !!(sccb->fac98 & 0x01);

	sclp.has_kss = !!(sccb->fac98 & 0x01);

	sclp.has_sipl = !!(sccb->cbl & 0x4000);

	if (sccb->fac85 & 0x02)

	if (sccb->fac85 & 0x02)

		S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;

		S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;

	if (sccb->fac91 & 0x40)

	if (sccb->fac91 & 0x40)

		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_GUEST;

		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_GUEST;

	if (sccb->cpuoff > 134)

	if (sccb->cpuoff > 134)

		sclp.has_diag318 = !!(sccb->byte_134 & 0x80);

		sclp.has_diag318 = !!(sccb->byte_134 & 0x80);

	if (sccb->cpuoff > 137)

		sclp.has_sipl = !!(sccb->cbl & 0x4000);

	sclp.rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;

	sclp.rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;

	sclp.rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;

	sclp.rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;

	sclp.rzm <<= 20;

	sclp.rzm <<= 20;