Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2780c1a authored by Julian Wiedmann's avatar Julian Wiedmann Committed by David S. Miller
Browse files

s390/qeth: cancel close_dev work before removing a card 



A card's close_dev work is scheduled on a driver-wide workqueue. If the
card is removed and freed while the work is still active, this causes a
use-after-free.
So make sure that the work is completed before freeing the card.

Fixes: 0f54761d ("qeth: Support VEPA mode")
Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent afa0c590

drivers/s390/net/qeth_core.h

+1 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/hashtable.h>

#include <linux/ip.h>

#include <linux/refcount.h>

#include <linux/workqueue.h>



#include <net/ipv6.h>

#include <net/if_inet6.h>

drivers/s390/net/qeth_l2_main.c

+2 −0
Original line number Diff line number Diff line
@@ -801,6 +801,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) 


	if (cgdev->state == CCWGROUP_ONLINE)

		qeth_l2_set_offline(cgdev);



	cancel_work_sync(&card->close_dev_work);

	if (qeth_netdev_is_registered(card->dev))

		unregister_netdev(card->dev);

}

drivers/s390/net/qeth_l3_main.c

+1 −0
Original line number Diff line number Diff line
@@ -2338,6 +2338,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) 
	if (cgdev->state == CCWGROUP_ONLINE)

		qeth_l3_set_offline(cgdev);



	cancel_work_sync(&card->close_dev_work);

	if (qeth_netdev_is_registered(card->dev))

		unregister_netdev(card->dev);

	qeth_l3_clear_ip_htable(card, 0);