This is a note to let you know that I've just added the patch titled
s390/sclp: Prevent release of buffer in I/O
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
s390-sclp-prevent-release-of-buffer-in-i-o.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit e4ed1e69d07be77475f8b1f465faf469ed69b156
Author: Peter Oberparleiter <oberpar@xxxxxxxxxxxxx>
Date: Thu Jun 20 14:20:27 2024 +0200
s390/sclp: Prevent release of buffer in I/O
[ Upstream commit bf365071ea92b9579d5a272679b74052a5643e35 ]
When a task waiting for completion of a Store Data operation is
interrupted, an attempt is made to halt this operation. If this attempt
fails due to a hardware or firmware problem, there is a chance that the
SCLP facility might store data into buffers referenced by the original
operation at a later time.
Handle this situation by not releasing the referenced data buffers if
the halt attempt fails. For current use cases, this might result in a
leak of few pages of memory in case of a rare hardware/firmware
malfunction.
Reviewed-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
Signed-off-by: Peter Oberparleiter <oberpar@xxxxxxxxxxxxx>
Signed-off-by: Alexander Gordeev <agordeev@xxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c
index 1e244f78f1929..64581433c3349 100644
--- a/drivers/s390/char/sclp_sd.c
+++ b/drivers/s390/char/sclp_sd.c
@@ -319,8 +319,14 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di)
&esize);
if (rc) {
/* Cancel running request if interrupted */
- if (rc == -ERESTARTSYS)
- sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL);
+ if (rc == -ERESTARTSYS) {
+ if (sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL)) {
+ pr_warn("Could not stop Store Data request - leaking at least %zu bytes\n",
+ (size_t)dsize * PAGE_SIZE);
+ data = NULL;
+ asce = 0;
+ }
+ }
vfree(data);
goto out;
}
