Peter Oberparleiter 0e501fd0f3 s390/cio: fix out-of-bounds access on cio_ignore free ... [ Upstream commit 1b60741127 ] The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0 ("s390/cio: avoid excessive path-verification requests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running. Fixes: 172da89ed0 ("s390/cio: avoid excessive path-verification requests") Fixes: 0c3812c347 ("s390/cio: derive cdev information only for IO-subchannels") Cc: <stable@vger.kernel.org> # v5.15 Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com> Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com> Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-11-10 18:15:33 +01:00
..
Makefile	…
airq.c	…
blacklist.c	…
blacklist.h	…
ccwgroup.c	s390/qeth: fix deadlock during failing recovery	2021-09-21 20:02:24 -07:00
ccwreq.c	…
chp.c	…
chp.h	…
chsc.c	…
chsc.h	…
chsc_sch.c	…
chsc_sch.h	…
cio.c	…
cio.h	…
cio_debug.h	…
cio_debugfs.c	s390/cio: introduce CIO debugfs directory	2021-03-22 11:36:04 +01:00
cio_inject.c	…
cio_inject.h	…
cmf.c	…
crw.c	…
css.c	…
css.h	s390/cio: avoid excessive path-verification requests	2021-09-27 13:54:38 +02:00
device.c	…
device.h	…
device_fsm.c	…
device_id.c	…
device_ops.c	…
device_pgid.c	s390/cio: add basic protected virtualization support	2019-06-15 12:25:00 +02:00
device_status.c	…
eadm_sch.c	…
eadm_sch.h	…
fcx.c	…
idset.c	…
idset.h	…
io_sch.h	…
ioasm.c	…
ioasm.h	s390: assume diag308 set always works	2018-04-10 07:38:59 +02:00
isc.c	…
itcw.c	…
orb.h	…
qdio.h	…
qdio_debug.c	…
qdio_debug.h	…
qdio_main.c	s390/qdio: remove unused support for SLIB parameters	2021-08-18 10:01:28 +02:00
qdio_setup.c	…
qdio_thinint.c	…
scm.c	…
trace.c	…
trace.h	s390: use struct tpi_info in lowcore.h	2021-06-07 17:07:01 +02:00
vfio_ccw_async.c	…
vfio_ccw_chp.c	…
vfio_ccw_cp.c	…
vfio_ccw_cp.h	…
vfio_ccw_drv.c	…
vfio_ccw_fsm.c	…
vfio_ccw_ops.c	…
vfio_ccw_private.h	…
vfio_ccw_trace.c	…
vfio_ccw_trace.h	…