s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

There is a wrong upper limit check for the domain value when an EP11
CPRB is processed for sending to a crypto card. This check is only
active on custom device nodes but may lead to access heap memory
behind perms->adm when an administrative CPRB is sent.
Add correct limit (AP_DOMAINS = 256) checking to fix this.

Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices")
Cc: stable@vger.kernel.org
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index f57189c2b839ee4db093d060b93045e4b9f5135f..81eefdeae248599b3819e636547525381f6b0a93 100644 (file)
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -1077,7 +1077,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
        print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
                             ap_msg.msg, ap_msg.len, false);
 
-       if (perms != &ap_perms && domain < AUTOSEL_DOM) {
+       if (perms != &ap_perms && domain < AP_DOMAINS) {
                if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
                        if (!test_bit_inv(domain, perms->adm)) {
                                rc = -ENODEV;