[PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[Vineeth Vijayan]

The channel path registry entry associated with a CHPID may be removed
while the subchannel's PMCW still references that CHPID. In this case,
chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
 
Add the missing NULL check before dereferencing the returned pointer.

Fixes: 199652309a4d ("s390/cio: add helper to query utility strings per given ccw device")
Cc: stable@vger.kernel.org
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
---
 drivers/s390/cio/device_ops.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index f2f7f8cba410..1f7e83fd5087 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -517,6 +517,8 @@ u8 *ccw_device_get_util_str(struct ccw_device *cdev, int chp_idx)
 	chp_id_init(&chpid);
 	chpid.id = sch->schib.pmcw.chpid[chp_idx];
 	chp = chpid_to_chp(chpid);
+	if (!chp)
+		return NULL;
 
 	util_str = kmalloc(sizeof(chp->desc_fmt3.util_str), GFP_KERNEL);
 	if (!util_str)
-- 
2.53.0

Re: [PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[sashiko-bot]

> The channel path registry entry associated with a CHPID may be removed
> while the subchannel's PMCW still references that CHPID. In this case,
> chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
>  
> Add the missing NULL check before dereferencing the returned pointer.
> 
> Fixes: 199652309a4d ("s390/cio: add helper to query utility strings per given ccw device")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922204839.965043-1-vneethv@linux.ibm.com?part=1

Re: [PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[Peter Oberparleiter]

On 22.09.2026 22:48, Vineeth Vijayan wrote:
> The channel path registry entry associated with a CHPID may be removed
> while the subchannel's PMCW still references that CHPID. In this case,
> chpid_to_chp() can return NULL, leading to a NULL pointer dereference.

Actually as I understand it, it is the other way around: the registry
(css->chps) still contains the entry, but the PMCW CHPID list contains 0
due a cleared SCHIB. Therefore the lookup will return NULL, unless by
chance a CHPID 0 exists.

> Add the missing NULL check before dereferencing the returned pointer.
> 
> Fixes: 199652309a4d ("s390/cio: add helper to query utility strings per given ccw device")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>

Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>


-- 
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D

Re: [PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[Vineeth Vijayan]

On 9/23/26 10:57, Peter Oberparleiter wrote:
> On 22.09.2026 22:48, Vineeth Vijayan wrote:
>> The channel path registry entry associated with a CHPID may be removed
>> while the subchannel's PMCW still references that CHPID. In this case,
>> chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
> 
> Actually as I understand it, it is the other way around: the registry
> (css->chps) still contains the entry, but the PMCW CHPID list contains 0
> due a cleared SCHIB. Therefore the lookup will return NULL, unless by
> chance a CHPID 0 exists.
> 

mm..This is also a possibility. But we are not clearing SCHIB here. We 
still cache the old unpredictable value to sch->schib. And then based on
this, we try to read some index of registry which could be a NULL.

>> Add the missing NULL check before dereferencing the returned pointer.
>>
>> Fixes: 199652309a4d ("s390/cio: add helper to query utility strings per given ccw device")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
> 
> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
> 
> 

Re: [PATCH] s390/cio: Fix NULL dereference in ccw_device_get_util_str()

[Heiko Carstens]

On Tue, Sep 22, 2026 at 10:48:39PM +0200, Vineeth Vijayan wrote:
> The channel path registry entry associated with a CHPID may be removed
> while the subchannel's PMCW still references that CHPID. In this case,
> chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
>  
> Add the missing NULL check before dereferencing the returned pointer.
> +	if (!chp)
> +		return NULL;
>  
>  	util_str = kmalloc(sizeof(chp->desc_fmt3.util_str), GFP_KERNEL);

The context diff is confusing; as if this would be the to be fixed bug :)
But ok, just a few lines below chp is indeed dereferenced.

Applied, thanks!