Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 48e4c385 authored by Peter Oberparleiter's avatar Peter Oberparleiter Committed by Martin Schwidefsky
Browse files

[S390] cio: fix double free in case of probe failure 



io_subchannel_probe() frees memory for sch->private which is later
freed again when io_subchannel_remove() is called. Fix this problem
by removing the cleanup in io_subchannel_probe().

Signed-off-by: default avatarPeter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent cf87b743

drivers/s390/cio/device.c

+5 −6
Original line number Diff line number Diff line
@@ -1292,7 +1292,7 @@ static int io_subchannel_probe(struct subchannel *sch) 
	sch->private = kzalloc(sizeof(struct io_subchannel_private),

			       GFP_KERNEL | GFP_DMA);

	if (!sch->private)

		goto out_err;

		goto out_schedule;

	/*

	 * First check if a fitting device may be found amongst the

	 * disconnected devices or in the orphanage.
@@ -1317,7 +1317,7 @@ static int io_subchannel_probe(struct subchannel *sch) 
	}

	cdev = io_subchannel_create_ccwdev(sch);

	if (IS_ERR(cdev))

		goto out_err;

		goto out_schedule;

	rc = io_subchannel_recog(cdev, sch);

	if (rc) {

		spin_lock_irqsave(sch->lock, flags);
@@ -1325,9 +1325,7 @@ static int io_subchannel_probe(struct subchannel *sch) 
		spin_unlock_irqrestore(sch->lock, flags);

	}

	return 0;

out_err:

	kfree(sch->private);

	sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);



out_schedule:

	io_subchannel_schedule_removal(sch);

	return 0;
@@ -1341,13 +1339,14 @@ io_subchannel_remove (struct subchannel *sch) 


	cdev = sch_get_cdev(sch);

	if (!cdev)

		return 0;

		goto out_free;

	/* Set ccw device to not operational and drop reference. */

	spin_lock_irqsave(cdev->ccwlock, flags);

	sch_set_cdev(sch, NULL);

	cdev->private->state = DEV_STATE_NOT_OPER;

	spin_unlock_irqrestore(cdev->ccwlock, flags);

	ccw_device_unregister(cdev);

out_free:

	kfree(sch->private);

	sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);

	return 0;