linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Julian Wiedmann <jwi@linux.vnet.ibm.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.14 10/46] s390/qeth: fix error handling in adapter command callbacks
Date: Thu, 25 Oct 2018 10:10:17 -0400	[thread overview]
Message-ID: <20181025141053.213330-10-sashal@kernel.org> (raw)
In-Reply-To: <20181025141053.213330-1-sashal@kernel.org>

From: Julian Wiedmann <jwi@linux.vnet.ibm.com>

[ Upstream commit 686c97ee29c886ee07d17987d0059874c5c3b5af ]

Make sure to check both return code fields before(!) processing the
command response. Otherwise we risk operating on invalid data.

This matches an earlier fix for SETASSPARMS commands, see
commit ad3cbf613329 ("s390/qeth: fix error handling in checksum cmd callback").

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_core_main.c | 85 ++++++++++++++-----------------
 1 file changed, 37 insertions(+), 48 deletions(-)

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 4f2747cd15a6..169dd7127f9e 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3001,28 +3001,23 @@ static int qeth_send_startlan(struct qeth_card *card)
 	return rc;
 }
 
-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
-		struct qeth_reply *reply, unsigned long data)
+static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
 {
-	struct qeth_ipa_cmd *cmd;
-
-	QETH_CARD_TEXT(card, 4, "defadpcb");
-
-	cmd = (struct qeth_ipa_cmd *) data;
-	if (cmd->hdr.return_code == 0)
+	if (!cmd->hdr.return_code)
 		cmd->hdr.return_code =
 			cmd->data.setadapterparms.hdr.return_code;
-	return 0;
+	return cmd->hdr.return_code;
 }
 
 static int qeth_query_setadapterparms_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 
 	QETH_CARD_TEXT(card, 3, "quyadpcb");
+	if (qeth_setadpparms_inspect_rc(cmd))
+		return 0;
 
-	cmd = (struct qeth_ipa_cmd *) data;
 	if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
 		card->info.link_type =
 		      cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
@@ -3030,7 +3025,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
 	}
 	card->options.adp.supported_funcs =
 		cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
-	return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+	return 0;
 }
 
 static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
@@ -3122,22 +3117,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
 static int qeth_query_switch_attributes_cb(struct qeth_card *card,
 				struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
-	struct qeth_switch_info *sw_info;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 	struct qeth_query_switch_attributes *attrs;
+	struct qeth_switch_info *sw_info;
 
 	QETH_CARD_TEXT(card, 2, "qswiatcb");
-	cmd = (struct qeth_ipa_cmd *) data;
-	sw_info = (struct qeth_switch_info *)reply->param;
-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
-		attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
-		sw_info->capabilities = attrs->capabilities;
-		sw_info->settings = attrs->settings;
-		QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
-							sw_info->settings);
-	}
-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+	if (qeth_setadpparms_inspect_rc(cmd))
+		return 0;
 
+	sw_info = (struct qeth_switch_info *)reply->param;
+	attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+	sw_info->capabilities = attrs->capabilities;
+	sw_info->settings = attrs->settings;
+	QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+			sw_info->settings);
 	return 0;
 }
 
@@ -4188,16 +4181,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
 static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 	struct qeth_ipacmd_setadpparms *setparms;
 
 	QETH_CARD_TEXT(card, 4, "prmadpcb");
 
-	cmd = (struct qeth_ipa_cmd *) data;
 	setparms = &(cmd->data.setadapterparms);
-
-	qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
-	if (cmd->hdr.return_code) {
+	if (qeth_setadpparms_inspect_rc(cmd)) {
 		QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
 		setparms->data.mode = SET_PROMISC_MODE_OFF;
 	}
@@ -4267,11 +4257,12 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
 static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 
 	QETH_CARD_TEXT(card, 4, "chgmaccb");
+	if (qeth_setadpparms_inspect_rc(cmd))
+		return 0;
 
-	cmd = (struct qeth_ipa_cmd *) data;
 	if (!card->options.layer2 ||
 	    !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
 		memcpy(card->dev->dev_addr,
@@ -4279,7 +4270,6 @@ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
 		       OSA_ADDR_LEN);
 		card->info.mac_bits |= QETH_LAYER2_MAC_READ;
 	}
-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
 	return 0;
 }
 
@@ -4310,13 +4300,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
 static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
 	struct qeth_set_access_ctrl *access_ctrl_req;
 	int fallback = *(int *)reply->param;
 
 	QETH_CARD_TEXT(card, 4, "setaccb");
+	if (cmd->hdr.return_code)
+		return 0;
+	qeth_setadpparms_inspect_rc(cmd);
 
-	cmd = (struct qeth_ipa_cmd *) data;
 	access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
 	QETH_DBF_TEXT_(SETUP, 2, "setaccb");
 	QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
@@ -4389,7 +4381,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
 			card->options.isolation = card->options.prev_isolation;
 		break;
 	}
-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
 	return 0;
 }
 
@@ -4677,14 +4668,15 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
 static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
 	struct qeth_qoat_priv *priv;
 	char *resdata;
 	int resdatalen;
 
 	QETH_CARD_TEXT(card, 3, "qoatcb");
+	if (qeth_setadpparms_inspect_rc(cmd))
+		return 0;
 
-	cmd = (struct qeth_ipa_cmd *)data;
 	priv = (struct qeth_qoat_priv *)reply->param;
 	resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
 	resdata = (char *)data + 28;
@@ -4778,21 +4770,18 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
 static int qeth_query_card_info_cb(struct qeth_card *card,
 				   struct qeth_reply *reply, unsigned long data)
 {
-	struct qeth_ipa_cmd *cmd;
+	struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
+	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
 	struct qeth_query_card_info *card_info;
-	struct carrier_info *carrier_info;
 
 	QETH_CARD_TEXT(card, 2, "qcrdincb");
-	carrier_info = (struct carrier_info *)reply->param;
-	cmd = (struct qeth_ipa_cmd *)data;
-	card_info = &cmd->data.setadapterparms.data.card_info;
-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
-		carrier_info->card_type = card_info->card_type;
-		carrier_info->port_mode = card_info->port_mode;
-		carrier_info->port_speed = card_info->port_speed;
-	}
+	if (qeth_setadpparms_inspect_rc(cmd))
+		return 0;
 
-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+	card_info = &cmd->data.setadapterparms.data.card_info;
+	carrier_info->card_type = card_info->card_type;
+	carrier_info->port_mode = card_info->port_mode;
+	carrier_info->port_speed = card_info->port_speed;
 	return 0;
 }
 
-- 
2.17.1


  parent reply	other threads:[~2018-10-25 14:11 UTC|newest]

Thread overview: 49+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-25 14:10 [PATCH AUTOSEL 4.14 01/46] iwlwifi: mvm: check for short GI only for OFDM Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 02/46] iwlwifi: dbg: allow wrt collection before ALIVE Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 03/46] iwlwifi: fix the ALIVE notification layout Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 04/46] x86/power: Fix some ordering bugs in __restore_processor_context() Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 05/46] tools/testing/nvdimm: unit test clear-error commands Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 06/46] usbip: vhci_hcd: update 'status' file header and format Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 07/46] scsi: aacraid: address UBSAN warning regression Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 08/46] IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 09/46] IB/rxe: put the pool on allocation failure Sasha Levin
2018-10-25 14:10 ` Sasha Levin [this message]
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 11/46] net/mlx5: Fix mlx5_get_vector_affinity function Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 12/46] powerpc/pseries: Add empty update_numa_cpu_lookup_table() for NUMA=n Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 13/46] dm integrity: fail early if required HMAC key is not available Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 14/46] net: phy: realtek: Use the dummy stubs for MMD register access for rtl8211b Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 15/46] net: phy: Add general dummy stubs for MMD register access Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 16/46] net/mlx5e: Refine ets validation function Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 17/46] scsi: qla2xxx: Avoid double completion of abort command Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 18/46] kbuild: set no-integrated-as before incl. arch Makefile Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 19/46] IB/mlx5: Avoid passing an invalid QP type to firmware Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 20/46] ARM: tegra: Fix ULPI regression on Tegra20 Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 21/46] l2tp: remove configurable payload offset Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 22/46] cifs: Use ULL suffix for 64-bit constant Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 23/46] test_bpf: Fix testing with CONFIG_BPF_JIT_ALWAYS_ON=y on other arches Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 24/46] KVM: x86: Update the exit_qualification access bits while walking an address Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 25/46] sparc64: Fix regression in pmdp_invalidate() Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 26/46] tpm: move the delay_msec increment after sleep in tpm_transmit() Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 27/46] bpf: sockmap, map_release does not hold refcnt for pinned maps Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 28/46] tpm: tpm_crb: relinquish locality on error path Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 29/46] xen-netfront: Update features after registering netdev Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 30/46] xen-netfront: Fix mismatched rtnl_unlock Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 31/46] IB/usnic: Update with bug fixes from core code Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 32/46] mmc: dw_mmc-rockchip: correct property names in debug Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 33/46] MIPS: Workaround GCC __builtin_unreachable reordering bug Sasha Levin
2018-10-25 19:52   ` Paul Burton
2018-10-26  7:36     ` Arnd Bergmann
2018-10-29 13:36       ` Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 34/46] lan78xx: Don't reset the interface on open Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 35/46] enic: do not overwrite error code Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 36/46] iio: buffer: fix the function signature to match implementation Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 37/46] selftests/powerpc: Add ptrace hw breakpoint test Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 38/46] scsi: ibmvfc: Avoid unnecessary port relogin Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 39/46] scsi: sd: Remember that READ CAPACITY(16) succeeded Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 40/46] btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 41/46] net: phy: phylink: Don't release NULL GPIO Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 42/46] x86/paravirt: Fix some warning messages Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 43/46] net: stmmac: mark PM functions as __maybe_unused Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 44/46] kconfig: fix the rule of mainmenu_stmt symbol Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 45/46] libertas: call into generic suspend code before turning off power Sasha Levin
2018-10-25 14:10 ` [PATCH AUTOSEL 4.14 46/46] perf tests: Fix indexing when invoking subtests Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181025141053.213330-10-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=jwi@linux.vnet.ibm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).