linux/drivers/s390/cio
Peter Oberparleiter 1b60741127 s390/cio: fix out-of-bounds access on cio_ignore free
The channel-subsystem-driver scans for newly available devices whenever
device-IDs are removed from the cio_ignore list using a command such as:

  echo free >/proc/cio_ignore

Since an I/O device scan might interfer with running I/Os, commit
172da89ed0 ("s390/cio: avoid excessive path-verification requests")
introduced an optimization to exclude online devices from the scan.

The newly added check for online devices incorrectly assumes that
an I/O-subchannel's drvdata points to a struct io_subchannel_private.
For devices that are bound to a non-default I/O subchannel driver, such
as the vfio_ccw driver, this results in an out-of-bounds read access
during each scan.

Fix this by changing the scan logic to rely on a driver-independent
online indication. For this we can use struct subchannel->config.ena,
which is the driver's requested subchannel-enabled state. Since I/Os
can only be started on enabled subchannels, this matches the intent
of the original optimization of not scanning devices where I/O might
be running.

Fixes: 172da89ed0 ("s390/cio: avoid excessive path-verification requests")
Fixes: 0c3812c347 ("s390/cio: derive cdev information only for IO-subchannels")
Cc: <stable@vger.kernel.org> # v5.15
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2022-10-26 14:47:31 +02:00
..
airq.c s390/airq: allow for airq structure that uses an input vector 2022-07-11 09:54:15 +02:00
blacklist.c s390/cio: avoid excessive path-verification requests 2021-09-27 13:54:38 +02:00
blacklist.h
ccwgroup.c s390/qeth: fix deadlock during failing recovery 2021-09-21 20:02:24 -07:00
ccwreq.c
chp.c s390: replace snprintf in show functions with sysfs_emit 2021-11-16 12:29:19 +01:00
chp.h
chsc_sch.c s390/cio: remove uevent suppress from cio driver 2021-12-06 14:42:24 +01:00
chsc_sch.h
chsc.c s390/stp: clock_delta should be signed 2022-05-11 14:40:57 +02:00
chsc.h
cio_debug.h
cio_debugfs.c
cio_inject.c
cio_inject.h
cio.c
cio.h s390/cio: Use driver_set_override() instead of open-coding 2022-04-22 17:13:54 +02:00
cmf.c
crw.c s390: remove invalid email address of Heiko Carstens 2022-02-06 23:31:29 +01:00
css.c s390/cio: fix out-of-bounds access on cio_ignore free 2022-10-26 14:47:31 +02:00
css.h s390/cio: avoid excessive path-verification requests 2021-09-27 13:54:38 +02:00
device_fsm.c s390: cleanup timer API use 2022-03-27 22:18:39 +02:00
device_id.c s390/cio: fix kernel doc comment 2021-09-07 13:38:42 +02:00
device_ops.c s390/cio: make ccw_device_dma_* more robust 2021-10-26 15:21:30 +02:00
device_pgid.c
device_status.c
device.c s390/cio: verify the driver availability for path_event call 2022-02-09 22:55:01 +01:00
device.h
eadm_sch.c s390: cleanup timer API use 2022-03-27 22:18:39 +02:00
eadm_sch.h
fcx.c
idset.c
idset.h
io_sch.h
ioasm.c s390/extable: move EX_TABLE define to asm-extable.h 2022-03-08 00:33:00 +01:00
ioasm.h
isc.c
itcw.c
Makefile
orb.h
qdio_debug.c s390: move from strlcpy with unused retval to strscpy 2022-08-30 22:00:33 +02:00
qdio_debug.h
qdio_main.c s390/qdio: remove unneeded sanity check in qdio_do_sqbs() 2021-12-06 14:42:26 +01:00
qdio_setup.c s390/qdio: clarify handler logic for qdio_handle_activate_check() 2021-12-06 14:42:25 +01:00
qdio_thinint.c s390/airq: pass more TPI info to airq handlers 2022-07-11 09:54:10 +02:00
qdio.h s390/qdio: clarify handler logic for qdio_handle_activate_check() 2021-12-06 14:42:25 +01:00
scm.c
trace.c
trace.h
vfio_ccw_async.c vfio/ccw: Remove private->mdev 2022-07-07 14:06:12 -06:00
vfio_ccw_chp.c
vfio_ccw_cp.c vfio/ccw: Add length to DMA_UNMAP checks 2022-08-01 13:36:46 -06:00
vfio_ccw_cp.h vfio/ccw: Add length to DMA_UNMAP checks 2022-08-01 13:36:46 -06:00
vfio_ccw_drv.c vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_fsm.c vfio/ccw: Check return code from subchannel quiesce 2022-08-01 13:36:47 -06:00
vfio_ccw_ops.c vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_private.h vfio/mdev: add mdev available instance checking to the core 2022-10-04 12:06:58 -06:00
vfio_ccw_trace.c
vfio_ccw_trace.h