linux-kernel - [PATCH 1/2] vfio: ccw: bypass bad idaw address when fetching IDAL ccws

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 11 Oct 2017 04:38:21 +0200
From:   Dong Jia Shi <bjsdjshi@...ux.vnet.ibm.com>
To:     linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
        kvm@...r.kernel.org
Cc:     cohuck@...hat.com, borntraeger@...ibm.com,
        bjsdjshi@...ux.vnet.ibm.com, pasic@...ux.vnet.ibm.com,
        pmorel@...ux.vnet.ibm.com
Subject: [PATCH 1/2] vfio: ccw: bypass bad idaw address when fetching IDAL ccws

We currently returns the same error code (-EFAULT) to indicate two
different error cases:
1. a bug in vfio-ccw implementation has been found.
2. a buggy channel program has been detected.

This brings difficulty for userland program (specifically Qemu) to
handle.

Let's use -EFAULT to only indicate the first case. For the second
case, we simply hand over the ccws to lower level for further
handling.

Notice:
Once a bad idaw address is detected, the current behavior is to
suppress the ssch. With this fix, the channel program will be
accepted, and partial of the channel program (the part ahead of
the bad idaw) could possibly be executed by the device before
I/O conclusion.

Suggested-by: Halil Pasic <pasic@...ux.vnet.ibm.com>
Reviewed-by: Pierre Morel <pmorel@...ux.vnet.ibm.com>
Signed-off-by: Dong Jia Shi <bjsdjshi@...ux.vnet.ibm.com>
---
 drivers/s390/cio/vfio_ccw_cp.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 5ccfdc80d0ec..722f8b8c7273 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -569,10 +569,6 @@ static int ccwchain_fetch_idal(struct ccwchain *chain,

 	for (i = 0; i < idaw_nr; i++) {
 		idaw_iova = *(idaws + i);
-		if (IS_ERR_VALUE(idaw_iova)) {
-			ret = -EFAULT;
-			goto out_free_idaws;
-		}

 		ret = pfn_array_alloc_pin(pat->pat_pa + i, cp->mdev,
 					  idaw_iova, 1);
-- 
2.13.5