lkml.org 
[lkml]   [2019]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.20 63/81] s390/qeth: cancel close_dev work before removing a card
    Date
    From: Julian Wiedmann <jwi@linux.ibm.com>

    [ Upstream commit c2780c1a3fb724560b1d44f7976e0de17bf153c7 ]

    A card's close_dev work is scheduled on a driver-wide workqueue. If the
    card is removed and freed while the work is still active, this causes a
    use-after-free.
    So make sure that the work is completed before freeing the card.

    Fixes: 0f54761d167f ("qeth: Support VEPA mode")
    Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/s390/net/qeth_core.h | 1 +
    drivers/s390/net/qeth_l2_main.c | 2 ++
    drivers/s390/net/qeth_l3_main.c | 1 +
    3 files changed, 4 insertions(+)

    diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
    index 99af1a0a33147..8999be74c5451 100644
    --- a/drivers/s390/net/qeth_core.h
    +++ b/drivers/s390/net/qeth_core.h
    @@ -22,6 +22,7 @@
    #include <linux/hashtable.h>
    #include <linux/ip.h>
    #include <linux/refcount.h>
    +#include <linux/workqueue.h>

    #include <net/ipv6.h>
    #include <net/if_inet6.h>
    diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
    index 8d3601891c62d..49fa09c67d49f 100644
    --- a/drivers/s390/net/qeth_l2_main.c
    +++ b/drivers/s390/net/qeth_l2_main.c
    @@ -823,6 +823,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)

    if (cgdev->state == CCWGROUP_ONLINE)
    qeth_l2_set_offline(cgdev);
    +
    + cancel_work_sync(&card->close_dev_work);
    if (qeth_netdev_is_registered(card->dev))
    unregister_netdev(card->dev);
    }
    diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
    index f08b745c20073..d1bf55b5c8e1b 100644
    --- a/drivers/s390/net/qeth_l3_main.c
    +++ b/drivers/s390/net/qeth_l3_main.c
    @@ -2428,6 +2428,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
    if (cgdev->state == CCWGROUP_ONLINE)
    qeth_l3_set_offline(cgdev);

    + cancel_work_sync(&card->close_dev_work);
    if (qeth_netdev_is_registered(card->dev))
    unregister_netdev(card->dev);
    qeth_l3_clear_ip_htable(card, 0);
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-02-28 16:10    [W:2.580 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site