linux-toradex.git/drivers/s390, branch master

Merge tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2026-07-31T23:42:34+00:00

Pull block fixes from Jens Axboe:

 - A set of fixes for s390/dasd, via Stefan

 - Fix for a missing stop of the timeout timer, if a disk has never been
   added

 - Clear kernel owned fields on ublk setup by default

* tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  s390/dasd: Fix undersized format-check buffer
  s390/dasd: Fix potential NULL pointer dereference
  s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly
  block: stop the timeout timer when releasing a never added disk
  ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

s390/dasd: Fix undersized format-check buffer

2026-07-31T14:28:08+00:00

fmt_buffer_size in dasd_eckd_check_device_format() is declared as
int, even though one of the multiplicands, sizeof(struct eckd_count),
is a size_t. The expression

    trkcount * rpt_max * sizeof(struct eckd_count)

is therefore correctly evaluated at 64-bit width, but the result is
silently truncated when it is stored back into the 32-bit
fmt_buffer_size variable. For a sufficiently large track range
(start_unit/stop_unit are caller-controlled) this truncation
yields a buffer size far smaller than the number of tracks actually
requested. kzalloc() then succeeds with an undersized allocation,
while the subsequent channel program build still operates on the
untruncated track count and writes past the end of that buffer.

Compute the buffer size with check_mul_overflow() and keep it in a
size_t, so that a value that no longer fits results in -EINVAL
instead of a silently truncated allocation size.

Fixes: 8fd575200db5 ("s390/dasd: Add new ioctl BIODASDCHECKFMT")
Cc: stable@vger.kernel.org #4.7
Reviewed-by: Jan Höppner 
Signed-off-by: Stefan Haberland 
Link: https://patch.msgid.link/20260727142840.567286-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe

s390/dasd: Fix potential NULL pointer dereference

2026-07-31T14:28:06+00:00

dasd_release_space() checks the implementation of the is_ese()
discipline function before calling it to determine if a given device is
an ESE DASD.

The current usage of the logical AND operator will lead to a NULL
pointer dereference as the function is called even if the function
pointer is NULL.

Fix this by using the logical OR operator.

Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space")
Cc: stable@vger.kernel.org # v5.3+
Reported-by: Vasily Gorbik 
Acked-by: Eduard Shishkin 
Reviewed-by: Stefan Haberland 
Signed-off-by: Jan Höppner 
Signed-off-by: Stefan Haberland 
Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe

s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly

2026-07-31T14:28:05+00:00

When all channel paths to a DASD device are lost and subsequently
recovered, the path event handler starts one IO per path via
dasd_sleep_on_immediatly() to execute read configuration data (RCD) with
high priority.

dasd_sleep_on_immediatly() works by terminating the currently running
request before inserting the new request.
If a concurrent caller, such as the attention handler
dasd_eckd_check_attention_work() or the summary unit
check handler summary_unit_check_handling_work(), also calls
dasd_sleep_on_immediatly() while a path verification RCD is in progress,
the RCD gets terminated.

The problem is that a terminated request transitions from CLEARED to
TERMINATED without going through the normal retry path in
__dasd_device_process_ccw_queue.

The RCD therefore returns -EIO, and the affected paths remain
non-operational after recovery. RCD CQRs used for path verification
already carry the DASD_CQR_VERIFY_PATH flag.

Extend _dasd_term_running_cqr() to check this flag: instead of terminating
such a request, return -EAGAIN. In dasd_sleep_on_immediatly(), loop on
-EAGAIN with a short sleep, waiting for the path verification request to
complete before inserting the new request.

This is consistent with the already indefinite wait_event() that
dasd_sleep_on_immediatly() uses for its own request, and all other callers
(attention handler, summary unit check handler, reserve/release/steal-lock)
benefit automatically without requiring changes.

Reviewed-by: Jan Höppner 
Signed-off-by: Stefan Haberland 
Link: https://patch.msgid.link/20260727142840.567286-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe

s390/qeth: Check CAP_NET_ADMIN for private ioctls

2026-07-28T01:05:19+00:00

Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
capable check to ensure unprivileged users cannot invoke them.

Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
Cc: stable@vger.kernel.org
Suggested-by: Christian Borntraeger 
Reviewed-by: Christian Borntraeger 
Reviewed-by: Alexandra Winter 
Signed-off-by: Aswin Karuvally 
Link: https://patch.msgid.link/20260723140050.762991-1-aswin@linux.ibm.com
Signed-off-by: Jakub Kicinski

s390/zcrypt: Remove the empty file

2026-07-08T15:02:47+00:00

The files has no real user because CEX2 and CEX3 device drivers
are removed, also remove these empty files.

Fixes: 5ac8c72462cd ("s390/zcrypt: remove CEX2 and CEX3 device drivers")
Signed-off-by: Rongguang Wei 
Reviewed-by: Holger Dengler 
Signed-off-by: Vasily Gorbik

Merge tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

2026-07-04T16:28:45+00:00

Pull s390 fixes from Vasily Gorbik:

 - Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation, and
   leaving protected key verification to the pkey handler

 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer

* tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/monwriter: Reject buffer reuse with different data length
  pkey: Move keytype check from pkey api to handler

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

s390/monwriter: Reject buffer reuse with different data length

2026-07-02T14:51:06+00:00

When data buffers are reused, e.g. for interval sample records, the
first record determines the data length, and the size of the buffer for
user copy. Current monwriter code does not check if the data length was
changed for subsequent records, which also would never happen for valid
user programs.

However, a malicious user could change the data length, resulting in out
of bounds user copy to the kernel buffer, and memory corruption. By
default, the monwriter misc device is created with root-only permissions,
so practical impact is typically low.

Fix this by checking for changed data length and rejecting such records.

Cc: stable@vger.kernel.org
Signed-off-by: Gerald Schaefer 
Reviewed-by: Christian Borntraeger 
Signed-off-by: Vasily Gorbik

pkey: Move keytype check from pkey api to handler

2026-07-01T15:10:53+00:00

The PKEY_VERIFYPROTK ioctl takes data from user-space and verifies the
contained protected key. While checking the integrity of the ioctl
request structure is the responsibility of the generic pkey_api code,
the verification of the contained protected key is the responsibility
of the pkey handler.

The keytype verification (based on the calculated bitsize of the key)
is part of the protected key verification and therefore the
responsibility of the pkey handler (which already verifies
it). Therefore the keytype verification is removed from the generic
pkey_api code.

As the calculation of the key bitsize is currently wrong, the removal
of the keytype check in pkey_api also removes this wrong
calculation. For this reason, the commit is flagged with the Fixes:
tag.

Cc: stable@kernel.org # 6.12+
Fixes: 8fcc231ce3be ("s390/pkey: Introduce pkey base with handler registry and handler modules")
Reviewed-by: Ingo Franzki 
Reviewed-by: Harald Freudenberger 
Signed-off-by: Holger Dengler 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Vasily Gorbik