| From: Julian Wiedmann <jwi@linux.ibm.com> |
| Date: Wed, 2 May 2018 08:48:43 +0200 |
| Subject: s390/qdio: fix access to uninitialized qdio_q fields |
| |
| commit e521813468f786271a87e78e8644243bead48fad upstream. |
| |
| Ever since CQ/QAOB support was added, calling qdio_free() straight after |
| qdio_alloc() results in qdio_release_memory() accessing uninitialized |
| memory (ie. q->u.out.use_cq and q->u.out.aobs). Followed by a |
| kmem_cache_free() on the random AOB addresses. |
| |
| For older kernels that don't have 6e30c549f6ca, the same applies if |
| qdio_establish() fails in the DEV_STATE_ONLINE check. |
| |
| While initializing q->u.out.use_cq would be enough to fix this |
| particular bug, the more future-proof change is to just zero-alloc the |
| whole struct. |
| |
| Fixes: 104ea556ee7f ("qdio: support asynchronous delivery of storage blocks") |
| Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> |
| Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/s390/cio/qdio_setup.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/s390/cio/qdio_setup.c |
| +++ b/drivers/s390/cio/qdio_setup.c |
| @@ -90,7 +90,7 @@ static int __qdio_allocate_qs(struct qdi |
| int i; |
| |
| for (i = 0; i < nr_queues; i++) { |
| - q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL); |
| + q = kmem_cache_zalloc(qdio_q_cache, GFP_KERNEL); |
| if (!q) |
| return -ENOMEM; |
| |
