Re: [PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[Vineeth Vijayan <vneethv@linux.ibm.com>]

On 9/23/26 10:57, Peter Oberparleiter wrote:
> On 22.09.2026 22:48, Vineeth Vijayan wrote:
>> The channel path registry entry associated with a CHPID may be removed
>> while the subchannel's PMCW still references that CHPID. In this case,
>> chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
> 
> Actually as I understand it, it is the other way around: the registry
> (css->chps) still contains the entry, but the PMCW CHPID list contains 0
> due a cleared SCHIB. Therefore the lookup will return NULL, unless by
> chance a CHPID 0 exists.
> 

mm..This is also a possibility. But we are not clearing SCHIB here. We 
still cache the old unpredictable value to sch->schib. And then based on
this, we try to read some index of registry which could be a NULL.

>> Add the missing NULL check before dereferencing the returned pointer.
>>
>> Fixes: 199652309a4d ("s390/cio: add helper to query utility strings per given ccw device")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
> 
> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
> 
>