Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit afa0c590 authored by Julian Wiedmann's avatar Julian Wiedmann Committed by David S. Miller
Browse files

s390/qeth: fix use-after-free in error path 



The error path in qeth_alloc_qdio_buffers() that takes care of
cleaning up the Output Queues is buggy. It first frees the queue, but
then calls qeth_clear_outq_buffers() with that very queue struct.

Make the call to qeth_clear_outq_buffers() part of the free action
(in the correct order), and while at it fix the naming of the helper.

Fixes: 0da9581d ("qeth: exploit asynchronous delivery of storage blocks")
Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: default avatarAlexandra Winter <wintera@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5065b2dd

drivers/s390/net/qeth_core_main.c

+6 −9
Original line number Diff line number Diff line
@@ -2395,11 +2395,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx) 
	return 0;

}



static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q)

static void qeth_free_output_queue(struct qeth_qdio_out_q *q)

{

	if (!q)

		return;



	qeth_clear_outq_buffers(q, 1);

	qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);

	kfree(q);

}
@@ -2473,10 +2474,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card) 
		card->qdio.out_qs[i]->bufs[j] = NULL;

	}

out_freeoutq:

	while (i > 0) {

		qeth_free_qdio_out_buf(card->qdio.out_qs[--i]);

		qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);

	}

	while (i > 0)

		qeth_free_output_queue(card->qdio.out_qs[--i]);

	kfree(card->qdio.out_qs);

	card->qdio.out_qs = NULL;

out_freepool:
@@ -2509,10 +2508,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card) 
	qeth_free_buffer_pool(card);

	/* free outbound qdio_qs */

	if (card->qdio.out_qs) {

		for (i = 0; i < card->qdio.no_out_queues; ++i) {

			qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);

			qeth_free_qdio_out_buf(card->qdio.out_qs[i]);

		}

		for (i = 0; i < card->qdio.no_out_queues; i++)

			qeth_free_output_queue(card->qdio.out_qs[i]);

		kfree(card->qdio.out_qs);

		card->qdio.out_qs = NULL;

	}