Patch "s390/sclp: Prevent release of buffer in I/O" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    s390/sclp: Prevent release of buffer in I/O

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     s390-sclp-prevent-release-of-buffer-in-i-o.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3abb325358c8ba00fd9fdcdf21bcb33da7e2252e
Author: Peter Oberparleiter <oberpar@xxxxxxxxxxxxx>
Date:   Thu Jun 20 14:20:27 2024 +0200

    s390/sclp: Prevent release of buffer in I/O
    
    [ Upstream commit bf365071ea92b9579d5a272679b74052a5643e35 ]
    
    When a task waiting for completion of a Store Data operation is
    interrupted, an attempt is made to halt this operation. If this attempt
    fails due to a hardware or firmware problem, there is a chance that the
    SCLP facility might store data into buffers referenced by the original
    operation at a later time.
    
    Handle this situation by not releasing the referenced data buffers if
    the halt attempt fails. For current use cases, this might result in a
    leak of few pages of memory in case of a rare hardware/firmware
    malfunction.
    
    Reviewed-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
    Signed-off-by: Peter Oberparleiter <oberpar@xxxxxxxxxxxxx>
    Signed-off-by: Alexander Gordeev <agordeev@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c
index f9e164be7568f..944e75beb160c 100644
--- a/drivers/s390/char/sclp_sd.c
+++ b/drivers/s390/char/sclp_sd.c
@@ -320,8 +320,14 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di)
 			  &esize);
 	if (rc) {
 		/* Cancel running request if interrupted */
-		if (rc == -ERESTARTSYS)
-			sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL);
+		if (rc == -ERESTARTSYS) {
+			if (sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL)) {
+				pr_warn("Could not stop Store Data request - leaking at least %zu bytes\n",
+					(size_t)dsize * PAGE_SIZE);
+				data = NULL;
+				asce = 0;
+			}
+		}
 		vfree(data);
 		goto out;
 	}