From nobody Fri Dec 19 20:52:59 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC885C32774 for ; Tue, 23 Aug 2022 09:59:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346836AbiHWJ7H (ORCPT ); Tue, 23 Aug 2022 05:59:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346985AbiHWJzh (ORCPT ); Tue, 23 Aug 2022 05:55:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 505689FAB6; Tue, 23 Aug 2022 01:46:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 18BA161485; Tue, 23 Aug 2022 08:46:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21ADFC433D6; Tue, 23 Aug 2022 08:46:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244408; bh=hKuHHiLafn/QwQz1nmKb0m+Sc2+ysGzFRZNdqguwTrI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lEq/DUBlLJs/KwS4ScFSMuWmSgWf8lZyUfDcKVcBmcVbvJiRb4vl5W2qpct0F57hq /mrPyDUjBxwOjrlLyw2s3r6FMBVMEy+WVk96AOCQdMHHJjWX9hkV55TKgqxU6/Rrmh 0eP+pJb+kqQcE5donPW1feJcKUioVip6KwEul09Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthew Wilcox , Heiko Carstens , Alexander Egorenkov , Alexander Gordeev , Sasha Levin Subject: [PATCH 4.14 133/229] s390/zcore: fix race when reading from hardware system area Date: Tue, 23 Aug 2022 10:24:54 +0200 Message-Id: <20220823080058.454139478@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Gordeev [ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ] Memory buffer used for reading out data from hardware system area is not protected against concurrent access. Reported-by: Matthew Wilcox Fixes: 411ed3225733 ("[S390] zfcpdump support.") Acked-by: Heiko Carstens Tested-by: Alexander Egorenkov Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.16= 58206891.git.agordeev@linux.ibm.com Signed-off-by: Alexander Gordeev Signed-off-by: Sasha Levin --- drivers/s390/char/zcore.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c index aaed778f67c4..9748ef463233 100644 --- a/drivers/s390/char/zcore.c +++ b/drivers/s390/char/zcore.c @@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; static struct dentry *zcore_hsa_file; static struct ipl_parameter_block *ipl_block; =20 +static DEFINE_MUTEX(hsa_buf_mutex); static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); =20 /* @@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long sr= c, size_t count) if (!hsa_available) return -ENODATA; =20 + mutex_lock(&hsa_buf_mutex); while (count) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { TRACE("sclp_sdias_copy() failed\n"); + mutex_unlock(&hsa_buf_mutex); return -EIO; } offset =3D src % PAGE_SIZE; bytes =3D min(PAGE_SIZE - offset, count); - if (copy_to_user(dest, hsa_buf + offset, bytes)) + if (copy_to_user(dest, hsa_buf + offset, bytes)) { + mutex_unlock(&hsa_buf_mutex); return -EFAULT; + } src +=3D bytes; dest +=3D bytes; count -=3D bytes; } + mutex_unlock(&hsa_buf_mutex); return 0; } =20 @@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, si= ze_t count) if (!hsa_available) return -ENODATA; =20 + mutex_lock(&hsa_buf_mutex); while (count) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { TRACE("sclp_sdias_copy() failed\n"); + mutex_unlock(&hsa_buf_mutex); return -EIO; } offset =3D src % PAGE_SIZE; @@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, si= ze_t count) dest +=3D bytes; count -=3D bytes; } + mutex_unlock(&hsa_buf_mutex); return 0; } =20 --=20 2.35.1