s390/zcore: fix race when reading from hardware system area

Memory buffer used for reading out data from hardware system
area is not protected against concurrent access.

Reported-by: Matthew Wilcox <willy@infradead.org>
Fixes: 5db25acea036 ("[S390] zfcpdump support.")
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.com
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>

diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 516783ba950f88390fae67709f412ee0f8861c6e..92b32ce645b95483dc32a3aab56db8c62a4ff4a0 100644 (file)
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -50,6 +50,7 @@ static struct dentry *zcore_reipl_file;
 static struct dentry *zcore_hsa_file;
 static struct ipl_parameter_block *zcore_ipl_block;
 
+static DEFINE_MUTEX(hsa_buf_mutex);
 static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);
 
 /*
@@ -66,19 +67,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
        if (!hsa_available)
                return -ENODATA;
 
+       mutex_lock(&hsa_buf_mutex);
        while (count) {
                if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
                        TRACE("sclp_sdias_copy() failed\n");
+                       mutex_unlock(&hsa_buf_mutex);
                        return -EIO;
                }
                offset = src % PAGE_SIZE;
                bytes = min(PAGE_SIZE - offset, count);
-               if (copy_to_user(dest, hsa_buf + offset, bytes))
+               if (copy_to_user(dest, hsa_buf + offset, bytes)) {
+                       mutex_unlock(&hsa_buf_mutex);
                        return -EFAULT;
+               }
                src += bytes;
                dest += bytes;
                count -= bytes;
        }
+       mutex_unlock(&hsa_buf_mutex);
        return 0;
 }
 
@@ -96,9 +102,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
        if (!hsa_available)
                return -ENODATA;
 
+       mutex_lock(&hsa_buf_mutex);
        while (count) {
                if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
                        TRACE("sclp_sdias_copy() failed\n");
+                       mutex_unlock(&hsa_buf_mutex);
                        return -EIO;
                }
                offset = src % PAGE_SIZE;
@@ -108,6 +116,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
                dest += bytes;
                count -= bytes;
        }
+       mutex_unlock(&hsa_buf_mutex);
        return 0;
 }