5.10-stable patches

added patches:
	s390-sclp-fix-secure-ipl-facility-detection.patch

diff --git a/queue-5.10/s390-sclp-fix-secure-ipl-facility-detection.patch b/queue-5.10/s390-sclp-fix-secure-ipl-facility-detection.patch
new file mode 100644 (file)
index 0000000..c07d117
--- /dev/null
+++ b/queue-5.10/s390-sclp-fix-secure-ipl-facility-detection.patch
@@ -0,0 +1,40 @@
+From d76b14f3971a0638b6cd0da289f8b48acee287d0 Mon Sep 17 00:00:00 2001
+From: Alexander Egorenkov <egorenar@linux.ibm.com>
+Date: Thu, 9 Sep 2021 12:20:56 +0200
+Subject: s390/sclp: fix Secure-IPL facility detection
+
+From: Alexander Egorenkov <egorenar@linux.ibm.com>
+
+commit d76b14f3971a0638b6cd0da289f8b48acee287d0 upstream.
+
+Prevent out-of-range access if the returned SCLP SCCB response is smaller
+in size than the address of the Secure-IPL flag.
+
+Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute")
+Cc: stable@vger.kernel.org # 5.2+
+Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/char/sclp_early.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/char/sclp_early.c
++++ b/drivers/s390/char/sclp_early.c
+@@ -40,13 +40,14 @@ static void __init sclp_early_facilities
+       sclp.has_gisaf = !!(sccb->fac118 & 0x08);
+       sclp.has_hvs = !!(sccb->fac119 & 0x80);
+       sclp.has_kss = !!(sccb->fac98 & 0x01);
+-      sclp.has_sipl = !!(sccb->cbl & 0x4000);
+       if (sccb->fac85 & 0x02)
+               S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;
+       if (sccb->fac91 & 0x40)
+               S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_GUEST;
+       if (sccb->cpuoff > 134)
+               sclp.has_diag318 = !!(sccb->byte_134 & 0x80);
++      if (sccb->cpuoff > 137)
++              sclp.has_sipl = !!(sccb->cbl & 0x4000);
+       sclp.rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
+       sclp.rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
+       sclp.rzm <<= 20;

diff --git a/queue-5.10/series b/queue-5.10/series
index 7c9046b2f0daea468a8d35531b40fdc321396a65..fdcc5a66f110c010db507216aca53b14176998a1 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -15,3 +15,4 @@ drm-etnaviv-exec-and-mmu-state-is-lost-when-resetting-the-gpu.patch
 drm-etnaviv-fix-mmu-context-leak-on-gpu-reset.patch
 drm-etnaviv-reference-mmu-context-when-setting-up-hardware-state.patch
 drm-etnaviv-add-missing-mmu-context-put-when-reaping-mmu-mapping.patch
+s390-sclp-fix-secure-ipl-facility-detection.patch