Vasily Gorbik 16c75eb13a s390/cio: avoid calling strlen on null pointer ... commit ea298e6ee8 upstream. Fix the following kasan finding: BUG: KASAN: global-out-of-bounds in ccwgroup_create_dev+0x850/0x1140 Read of size 1 at addr 0000000000000000 by task systemd-udevd.r/561 CPU: 30 PID: 561 Comm: systemd-udevd.r Tainted: G B Hardware name: IBM 3906 M04 704 (LPAR) Call Trace: ([<0000000231b3db7e>] show_stack+0x14e/0x1a8) [<0000000233826410>] dump_stack+0x1d0/0x218 [<000000023216fac4>] print_address_description+0x64/0x380 [<000000023216f5a8>] __kasan_report+0x138/0x168 [<00000002331b8378>] ccwgroup_create_dev+0x850/0x1140 [<00000002332b618a>] group_store+0x3a/0x50 [<00000002323ac706>] kernfs_fop_write+0x246/0x3b8 [<00000002321d409a>] vfs_write+0x132/0x450 [<00000002321d47da>] ksys_write+0x122/0x208 [<0000000233877102>] system_call+0x2a6/0x2c8 Triggered by: openat(AT_FDCWD, "/sys/bus/ccwgroup/drivers/qeth/group", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 16 write(16, "0.0.bd00,0.0.bd01,0.0.bd02", 26) = 26 The problem is that __get_next_id in ccwgroup_create_dev might set "buf" buffer pointer to NULL and explicit check for that is required. Cc: stable@vger.kernel.org Reviewed-by: Sebastian Ott <sebott@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-10-11 18:21:08 +02:00
..
Makefile	…
airq.c	…
blacklist.c	…
blacklist.h	…
ccwgroup.c	s390/cio: avoid calling strlen on null pointer	2019-10-11 18:21:08 +02:00
ccwreq.c	…
chp.c	…
chp.h	…
chsc.c	…
chsc.h	…
chsc_sch.c	…
chsc_sch.h	…
cio.c	…
cio.h	s390: cio: fix cio_irb declaration	2019-05-31 06:46:24 -07:00
cio_debug.h	…
cmf.c	…
crw.c	…
css.c	s390/cio: exclude subchannels with no parent from pseudo check	2019-10-11 18:20:43 +02:00
css.h	…
device.c	…
device.h	…
device_fsm.c	…
device_id.c	…
device_ops.c	…
device_pgid.c	…
device_status.c	…
eadm_sch.c	…
eadm_sch.h	…
fcx.c	…
idset.c	…
idset.h	…
io_sch.h	…
ioasm.c	…
ioasm.h	…
isc.c	…
itcw.c	…
orb.h	…
qdio.h	…
qdio_debug.c	…
qdio_debug.h	…
qdio_main.c	s390/qdio: add sanity checks to the fast-requeue path	2019-08-16 10:12:46 +02:00
qdio_setup.c	s390/qdio: (re-)initialize tiqdio list entries	2019-07-21 09:03:15 +02:00
qdio_thinint.c	s390/qdio: don't touch the dsci in tiqdio_add_input_queues()	2019-07-21 09:03:15 +02:00
scm.c	…
trace.c	…
trace.h	…
vfio_ccw_cp.c	vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn	2019-08-16 10:12:43 +02:00
vfio_ccw_cp.h	…
vfio_ccw_drv.c	vfio-ccw: Prevent quiesce function going into an infinite loop	2019-05-31 06:46:35 -07:00
vfio_ccw_fsm.c	…
vfio_ccw_ops.c	vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev	2019-05-31 06:46:16 -07:00
vfio_ccw_private.h	…
vfio_ccw_trace.h	…