acrn-kernel/drivers/s390/cio
Peter Oberparleiter 1b60741127 s390/cio: fix out-of-bounds access on cio_ignore free
The channel-subsystem-driver scans for newly available devices whenever
device-IDs are removed from the cio_ignore list using a command such as:

  echo free >/proc/cio_ignore

Since an I/O device scan might interfer with running I/Os, commit
172da89ed0 ("s390/cio: avoid excessive path-verification requests")
introduced an optimization to exclude online devices from the scan.

The newly added check for online devices incorrectly assumes that
an I/O-subchannel's drvdata points to a struct io_subchannel_private.
For devices that are bound to a non-default I/O subchannel driver, such
as the vfio_ccw driver, this results in an out-of-bounds read access
during each scan.

Fix this by changing the scan logic to rely on a driver-independent
online indication. For this we can use struct subchannel->config.ena,
which is the driver's requested subchannel-enabled state. Since I/Os
can only be started on enabled subchannels, this matches the intent
of the original optimization of not scanning devices where I/O might
be running.

Fixes: 172da89ed0 ("s390/cio: avoid excessive path-verification requests")
Fixes: 0c3812c347 ("s390/cio: derive cdev information only for IO-subchannels")
Cc: <stable@vger.kernel.org> # v5.15
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2022-10-26 14:47:31 +02:00
..
Makefile
airq.c s390/airq: allow for airq structure that uses an input vector 2022-07-11 09:54:15 +02:00
blacklist.c
blacklist.h
ccwgroup.c
ccwreq.c
chp.c
chp.h
chsc.c
chsc.h
chsc_sch.c
chsc_sch.h
cio.c
cio.h
cio_debug.h
cio_debugfs.c
cio_inject.c
cio_inject.h
cmf.c
crw.c
css.c s390/cio: fix out-of-bounds access on cio_ignore free 2022-10-26 14:47:31 +02:00
css.h
device.c
device.h
device_fsm.c
device_id.c
device_ops.c
device_pgid.c
device_status.c
eadm_sch.c
eadm_sch.h
fcx.c
idset.c
idset.h
io_sch.h
ioasm.c
ioasm.h
isc.c
itcw.c
orb.h
qdio.h
qdio_debug.c s390: move from strlcpy with unused retval to strscpy 2022-08-30 22:00:33 +02:00
qdio_debug.h
qdio_main.c
qdio_setup.c
qdio_thinint.c s390/airq: pass more TPI info to airq handlers 2022-07-11 09:54:10 +02:00
scm.c
trace.c
trace.h
vfio_ccw_async.c vfio/ccw: Remove private->mdev 2022-07-07 14:06:12 -06:00
vfio_ccw_chp.c
vfio_ccw_cp.c vfio/ccw: Add length to DMA_UNMAP checks 2022-08-01 13:36:46 -06:00
vfio_ccw_cp.h vfio/ccw: Add length to DMA_UNMAP checks 2022-08-01 13:36:46 -06:00
vfio_ccw_drv.c vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_fsm.c vfio/ccw: Check return code from subchannel quiesce 2022-08-01 13:36:47 -06:00
vfio_ccw_ops.c vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_private.h vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_trace.c
vfio_ccw_trace.h