mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
s390/zcore: fix race when reading from hardware system area
Memory buffer used for reading out data from hardware system
area is not protected against concurrent access.
Reported-by: Matthew Wilcox <willy@infradead.org>
Fixes: 411ed32257
("[S390] zfcpdump support.")
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.com
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
This commit is contained in:
parent
f6749da17a
commit
9ffed254d9
1 changed files with 10 additions and 1 deletions
|
@ -50,6 +50,7 @@ static struct dentry *zcore_reipl_file;
|
||||||
static struct dentry *zcore_hsa_file;
|
static struct dentry *zcore_hsa_file;
|
||||||
static struct ipl_parameter_block *zcore_ipl_block;
|
static struct ipl_parameter_block *zcore_ipl_block;
|
||||||
|
|
||||||
|
static DEFINE_MUTEX(hsa_buf_mutex);
|
||||||
static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);
|
static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -66,19 +67,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
|
||||||
if (!hsa_available)
|
if (!hsa_available)
|
||||||
return -ENODATA;
|
return -ENODATA;
|
||||||
|
|
||||||
|
mutex_lock(&hsa_buf_mutex);
|
||||||
while (count) {
|
while (count) {
|
||||||
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
|
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
|
||||||
TRACE("sclp_sdias_copy() failed\n");
|
TRACE("sclp_sdias_copy() failed\n");
|
||||||
|
mutex_unlock(&hsa_buf_mutex);
|
||||||
return -EIO;
|
return -EIO;
|
||||||
}
|
}
|
||||||
offset = src % PAGE_SIZE;
|
offset = src % PAGE_SIZE;
|
||||||
bytes = min(PAGE_SIZE - offset, count);
|
bytes = min(PAGE_SIZE - offset, count);
|
||||||
if (copy_to_user(dest, hsa_buf + offset, bytes))
|
if (copy_to_user(dest, hsa_buf + offset, bytes)) {
|
||||||
|
mutex_unlock(&hsa_buf_mutex);
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
}
|
||||||
src += bytes;
|
src += bytes;
|
||||||
dest += bytes;
|
dest += bytes;
|
||||||
count -= bytes;
|
count -= bytes;
|
||||||
}
|
}
|
||||||
|
mutex_unlock(&hsa_buf_mutex);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -96,9 +102,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
|
||||||
if (!hsa_available)
|
if (!hsa_available)
|
||||||
return -ENODATA;
|
return -ENODATA;
|
||||||
|
|
||||||
|
mutex_lock(&hsa_buf_mutex);
|
||||||
while (count) {
|
while (count) {
|
||||||
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
|
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
|
||||||
TRACE("sclp_sdias_copy() failed\n");
|
TRACE("sclp_sdias_copy() failed\n");
|
||||||
|
mutex_unlock(&hsa_buf_mutex);
|
||||||
return -EIO;
|
return -EIO;
|
||||||
}
|
}
|
||||||
offset = src % PAGE_SIZE;
|
offset = src % PAGE_SIZE;
|
||||||
|
@ -108,6 +116,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
|
||||||
dest += bytes;
|
dest += bytes;
|
||||||
count -= bytes;
|
count -= bytes;
|
||||||
}
|
}
|
||||||
|
mutex_unlock(&hsa_buf_mutex);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue