[PULL 1/1] s390/cio: Fix how vfio-ccw checks pinned pages

[PULL 1/1] s390/cio: Fix how vfio-ccw checks pinned pages

[Cornelia Huck]

From: Eric Farman <farman@linux.ibm.com>

We have two nested loops to check the entries within the pfn_array_table
arrays.  But we mistakenly use the outer array as an index in our check,
and completely ignore the indexing performed by the inner loop.

Cc: stable@vger.kernel.org
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20181002010235.42483-1-farman@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 drivers/s390/cio/vfio_ccw_cp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index dbe7c7ac9ac8..fd77e46eb3b2 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -163,7 +163,7 @@ static bool pfn_array_table_iova_pinned(struct pfn_array_table *pat,
 
 	for (i = 0; i < pat->pat_nr; i++, pa++)
 		for (j = 0; j < pa->pa_nr; j++)
-			if (pa->pa_iova_pfn[i] == iova_pfn)
+			if (pa->pa_iova_pfn[j] == iova_pfn)
 				return true;
 
 	return false;
-- 
2.14.4

Re: [PULL 1/1] s390/cio: Fix how vfio-ccw checks pinned pages

[Farhan Ali]

On 10/02/2018 11:37 AM, Cornelia Huck wrote:
> From: Eric Farman <farman@linux.ibm.com>
> 
> We have two nested loops to check the entries within the pfn_array_table
> arrays.  But we mistakenly use the outer array as an index in our check,
> and completely ignore the indexing performed by the inner loop.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> Message-Id: <20181002010235.42483-1-farman@linux.ibm.com>
> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
> ---
>   drivers/s390/cio/vfio_ccw_cp.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index dbe7c7ac9ac8..fd77e46eb3b2 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -163,7 +163,7 @@ static bool pfn_array_table_iova_pinned(struct pfn_array_table *pat,
> 
>   	for (i = 0; i < pat->pat_nr; i++, pa++)
>   		for (j = 0; j < pa->pa_nr; j++)
> -			if (pa->pa_iova_pfn[i] == iova_pfn)
> +			if (pa->pa_iova_pfn[j] == iova_pfn)
>   				return true;
> 
>   	return false;
> 

Me and Jason have been looking at this code recently and we think this 
is the right fix.

Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.vnet.ibm.com>

Re: [PULL 0/1] vfio-ccw: another bugfix

[Martin Schwidefsky]

On Tue,  2 Oct 2018 17:37:47 +0200
Cornelia Huck <cohuck@redhat.com> wrote:

> [Sorry about that; I don't plan to make this a daily thing...]
> 
> The following changes since commit c458dda3d07c110ce1d007998f67273325ad8662:
> 
>   Merge tag 'vfio-ccw-20181001' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into fixes (2018-10-01 16:07:42 +0200)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw.git tags/vfio-ccw-20181002
> 
> for you to fetch changes up to 24abf2901b18bf941b9f21ea2ce5791f61097ae4:
> 
>   s390/cio: Fix how vfio-ccw checks pinned pages (2018-10-02 09:45:05 +0200)
> 
> ----------------------------------------------------------------
> Another fix for vfio-ccw: make sure it accesses the correct entries
> in the pfn_array_table arrays when checking pinned pages.
> 
> ----------------------------------------------------------------
> 
> Eric Farman (1):
>   s390/cio: Fix how vfio-ccw checks pinned pages
> 
>  drivers/s390/cio/vfio_ccw_cp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Pulled and push to linux-s390:fixes. I'll wait for a couple of days
before I send a please pull to Greg with the fixes.

Thanks.

-- 
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.