Commit 9ffed254 authored by Alexander Gordeev's avatar Alexander Gordeev

s390/zcore: fix race when reading from hardware system area

Memory buffer used for reading out data from hardware system
area is not protected against concurrent access.
Reported-by: default avatarMatthew Wilcox <willy@infradead.org>
Fixes: 411ed322 ("[S390] zfcpdump support.")
Acked-by: default avatarHeiko Carstens <hca@linux.ibm.com>
Tested-by: default avatarAlexander Egorenkov <egorenar@linux.ibm.com>
Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.comSigned-off-by: default avatarAlexander Gordeev <agordeev@linux.ibm.com>
parent f6749da1
...@@ -50,6 +50,7 @@ static struct dentry *zcore_reipl_file; ...@@ -50,6 +50,7 @@ static struct dentry *zcore_reipl_file;
static struct dentry *zcore_hsa_file; static struct dentry *zcore_hsa_file;
static struct ipl_parameter_block *zcore_ipl_block; static struct ipl_parameter_block *zcore_ipl_block;
static DEFINE_MUTEX(hsa_buf_mutex);
static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);
/* /*
...@@ -66,19 +67,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count) ...@@ -66,19 +67,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
if (!hsa_available) if (!hsa_available)
return -ENODATA; return -ENODATA;
mutex_lock(&hsa_buf_mutex);
while (count) { while (count) {
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
TRACE("sclp_sdias_copy() failed\n"); TRACE("sclp_sdias_copy() failed\n");
mutex_unlock(&hsa_buf_mutex);
return -EIO; return -EIO;
} }
offset = src % PAGE_SIZE; offset = src % PAGE_SIZE;
bytes = min(PAGE_SIZE - offset, count); bytes = min(PAGE_SIZE - offset, count);
if (copy_to_user(dest, hsa_buf + offset, bytes)) if (copy_to_user(dest, hsa_buf + offset, bytes)) {
mutex_unlock(&hsa_buf_mutex);
return -EFAULT; return -EFAULT;
}
src += bytes; src += bytes;
dest += bytes; dest += bytes;
count -= bytes; count -= bytes;
} }
mutex_unlock(&hsa_buf_mutex);
return 0; return 0;
} }
...@@ -96,9 +102,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) ...@@ -96,9 +102,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
if (!hsa_available) if (!hsa_available)
return -ENODATA; return -ENODATA;
mutex_lock(&hsa_buf_mutex);
while (count) { while (count) {
if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
TRACE("sclp_sdias_copy() failed\n"); TRACE("sclp_sdias_copy() failed\n");
mutex_unlock(&hsa_buf_mutex);
return -EIO; return -EIO;
} }
offset = src % PAGE_SIZE; offset = src % PAGE_SIZE;
...@@ -108,6 +116,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) ...@@ -108,6 +116,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
dest += bytes; dest += bytes;
count -= bytes; count -= bytes;
} }
mutex_unlock(&hsa_buf_mutex);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment