| From e2d135966920d1bf6860f5b6b9be16073e97438e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 30 Jan 2026 21:47:59 +0100 |
| Subject: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() |
| |
| From: Salah Triki <salah.triki@gmail.com> |
| |
| [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] |
| |
| `css_alloc_subchannel()` calls `device_initialize()` before setting up |
| the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, |
| the error path frees the subchannel structure directly, bypassing |
| the device model reference counting. |
| |
| Once `device_initialize()` has been called, the embedded struct device |
| must be released via `put_device()`, allowing the release callback to |
| free the container structure. |
| |
| Fix the error path by dropping the initial device reference with |
| `put_device()` instead of calling `kfree()` directly. |
| |
| This ensures correct device lifetime handling and avoids potential |
| use-after-free or double-free issues. |
| |
| Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") |
| Signed-off-by: Salah Triki <salah.triki@gmail.com> |
| Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com> |
| Signed-off-by: Heiko Carstens <hca@linux.ibm.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/s390/cio/css.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c |
| index 7b59d20bf7850..61be7c0550bc4 100644 |
| --- a/drivers/s390/cio/css.c |
| +++ b/drivers/s390/cio/css.c |
| @@ -236,7 +236,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, |
| return sch; |
| |
| err: |
| - kfree(sch); |
| + put_device(&sch->dev); |
| return ERR_PTR(ret); |
| } |
| |
| -- |
| 2.51.0 |
| |
