leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ea298e6ee8
linux/drivers/s390/cio
History
Vasily Gorbik ea298e6ee8 s390/cio: avoid calling strlen on null pointer 
Fix the following kasan finding:
BUG: KASAN: global-out-of-bounds in ccwgroup_create_dev+0x850/0x1140
Read of size 1 at addr 0000000000000000 by task systemd-udevd.r/561

CPU: 30 PID: 561 Comm: systemd-udevd.r Tainted: G    B
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
([<0000000231b3db7e>] show_stack+0x14e/0x1a8)
 [<0000000233826410>] dump_stack+0x1d0/0x218
 [<000000023216fac4>] print_address_description+0x64/0x380
 [<000000023216f5a8>] __kasan_report+0x138/0x168
 [<00000002331b8378>] ccwgroup_create_dev+0x850/0x1140
 [<00000002332b618a>] group_store+0x3a/0x50
 [<00000002323ac706>] kernfs_fop_write+0x246/0x3b8
 [<00000002321d409a>] vfs_write+0x132/0x450
 [<00000002321d47da>] ksys_write+0x122/0x208
 [<0000000233877102>] system_call+0x2a6/0x2c8

Triggered by:
openat(AT_FDCWD, "/sys/bus/ccwgroup/drivers/qeth/group",
		O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 16
write(16, "0.0.bd00,0.0.bd01,0.0.bd02", 26) = 26

The problem is that __get_next_id in ccwgroup_create_dev might set "buf"
buffer pointer to NULL and explicit check for that is required.

Cc: stable@vger.kernel.org
Reviewed-by: Sebastian Ott <sebott@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2019-09-23 23:27:52 +02:00
..
airq.c s390/airq: use DMA memory for adapter interrupts 2019-06-15 12:25:05 +02:00
blacklist.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
blacklist.h s390: add a few more SPDX identifiers 2017-12-05 07:51:09 +01:00
ccwgroup.c s390/cio: avoid calling strlen on null pointer 2019-09-23 23:27:52 +02:00
ccwreq.c s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
chp.c s390/cio: ensure that a chpid is registered only once 2018-07-17 07:27:51 +02:00
chp.h s390/chsc: query utility strings via fmt3 channel path descriptor 2018-03-26 16:13:16 +02:00
chsc_sch.c driver_find_device: Unify the match function with class_find_device() 2019-06-24 05:22:31 +02:00
chsc_sch.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
chsc.c s390/cio: move struct node_descriptor to cio.h 2019-06-19 17:54:27 +02:00
chsc.h s390/cio: add function chsc_sgib() 2019-02-05 14:29:23 +01:00
cio_debug.h Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2017-11-13 11:47:01 -08:00
cio.c s390: show statistics for MSI IRQs 2019-04-29 10:47:01 +02:00
cio.h s390/cio: introduce driver_override on the css bus 2019-07-02 16:00:26 +02:00
cmf.c mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
crw.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
css.c Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
css.h s390/css: reduce stsch calls 2018-07-17 07:27:55 +02:00
device_fsm.c s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
device_id.c s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
device_ops.c s390/cio: fix intparm documentation 2019-09-19 12:56:06 +02:00
device_pgid.c s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
device_status.c s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
device.c Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
device.h s390/cio: Convert timers to use timer_setup() 2017-11-14 11:01:36 +01:00
eadm_sch.c s390: cio: add SPDX identifiers to the remaining files 2017-11-24 14:28:41 +01:00
eadm_sch.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fcx.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idset.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idset.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
io_sch.h s390/cio: add basic protected virtualization support 2019-06-15 12:25:00 +02:00
ioasm.c s390/cio: export hsch to modules 2019-04-24 14:18:51 +02:00
ioasm.h s390: assume diag308 set always works 2018-04-10 07:38:59 +02:00
isc.c s390: cio: add SPDX identifiers to the remaining files 2017-11-24 14:28:41 +01:00
itcw.c s390/cio: fix kernel-doc usage 2018-02-05 07:34:52 +01:00
Makefile vfio-ccw: add handling for async channel instructions 2019-04-24 14:18:51 +02:00
orb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
qdio_debug.c s390/qdio: eliminate queue's last_move cursor 2019-04-10 17:47:26 +02:00
qdio_debug.h Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2017-11-13 11:47:01 -08:00
qdio_main.c s390/qdio: restrict QAOB usage to IQD unicast queues 2019-07-23 10:44:03 +02:00
qdio_setup.c s390/qdio: (re-)initialize tiqdio list entries 2019-07-02 16:00:27 +02:00
qdio_thinint.c s390/qdio: don't touch the dsci in tiqdio_add_input_queues() 2019-07-02 16:00:27 +02:00
qdio.h s390/qdio: eliminate queue's last_move cursor 2019-04-10 17:47:26 +02:00
scm.c bus_find_device: Unify the match callback with class_find_device 2019-06-24 05:22:31 +02:00
trace.c s390/cio: Remove tracing for rchp instruction 2019-05-08 15:01:22 +02:00
trace.h s390/cio: Remove tracing for rchp instruction 2019-05-08 15:01:22 +02:00
vfio_ccw_async.c vfio-ccw: make vfio_ccw_async_region_ops static 2019-07-29 18:05:03 +02:00
vfio_ccw_cp.c vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn 2019-07-15 14:16:37 +02:00
vfio_ccw_cp.h vfio-ccw: Move guest_cp storage into common struct 2019-06-21 14:12:19 +02:00
vfio_ccw_drv.c vfio-ccw: fix error return code in vfio_ccw_sch_init() 2019-09-05 15:18:15 +02:00
vfio_ccw_fsm.c vfio-ccw: add some logging 2019-08-23 12:53:32 +02:00
vfio_ccw_ops.c vfio-ccw: add some logging 2019-08-23 12:53:32 +02:00
vfio_ccw_private.h vfio-ccw: add some logging 2019-08-23 12:53:32 +02:00
vfio_ccw_trace.h vfio: ccw: add tracepoints for interesting error paths 2018-05-29 09:27:42 +02:00