Peter Oberparleiter 0e501fd0f3 s390/cio: fix out-of-bounds access on cio_ignore free ... [ Upstream commit 1b60741127 ] The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0 ("s390/cio: avoid excessive path-verification requests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running. Fixes: 172da89ed0 ("s390/cio: avoid excessive path-verification requests") Fixes: 0c3812c347 ("s390/cio: derive cdev information only for IO-subchannels") Cc: <stable@vger.kernel.org> # v5.15 Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com> Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com> Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-11-10 18:15:33 +01:00
..
Makefile	…
airq.c	…
blacklist.c	…
blacklist.h	…
ccwgroup.c	…
ccwreq.c	…
chp.c	…
chp.h	…
chsc.c	…
chsc.h	…
chsc_sch.c	…
chsc_sch.h	…
cio.c	…
cio.h	…
cio_debug.h	…
cio_debugfs.c	…
cio_inject.c	…
cio_inject.h	…
cmf.c	…
crw.c	…
css.c	s390/cio: fix out-of-bounds access on cio_ignore free	2022-11-10 18:15:33 +01:00
css.h	…
device.c	…
device.h	…
device_fsm.c	…
device_id.c	…
device_ops.c	…
device_pgid.c	…
device_status.c	…
eadm_sch.c	…
eadm_sch.h	…
fcx.c	…
idset.c	…
idset.h	…
io_sch.h	…
ioasm.c	…
ioasm.h	…
isc.c	…
itcw.c	…
orb.h	…
qdio.h	…
qdio_debug.c	…
qdio_debug.h	…
qdio_main.c	…
qdio_setup.c	…
qdio_thinint.c	…
scm.c	…
trace.c	…
trace.h	…
vfio_ccw_async.c	…
vfio_ccw_chp.c	…
vfio_ccw_cp.c	…
vfio_ccw_cp.h	…
vfio_ccw_drv.c	vfio/ccw: Do not change FSM state in subchannel event	2022-08-17 14:24:06 +02:00
vfio_ccw_fsm.c	…
vfio_ccw_ops.c	…
vfio_ccw_private.h	…
vfio_ccw_trace.c	…
vfio_ccw_trace.h	…