• Julian Wiedmann's avatar
    s390/qdio: (re-)initialize tiqdio list entries · 1f5dcaa9
    Julian Wiedmann authored
    commit e54e4785 upstream.
    
    When tiqdio_remove_input_queues() removes a queue from the tiq_list as
    part of qdio_shutdown(), it doesn't re-initialize the queue's list entry
    and the prev/next pointers go stale.
    
    If a subsequent qdio_establish() fails while sending the ESTABLISH cmd,
    it calls qdio_shutdown() again in QDIO_IRQ_STATE_ERR state and
    tiqdio_remove_input_queues() will attempt to remove the queue entry a
    second time. This dereferences the stale pointers, and bad things ensue.
    Fix this by re-initializing the list entry after removing it from the
    list.
    
    For good practice also initialize the list entry when the queue is first
    allocated, and remove the quirky checks that papered over this omission.
    Note that prior to
    commit e5218134 ("s390/qdio: fix access to uninitialized qdio_q fields"),
    these checks were bogus anyway.
    
    setup_queues_misc() clears the whole queue struct, and thus needs to
    re-init the prev/next pointers as well.
    
    Fixes: 779e6e1c ("[S390] qdio: new qdio driver.")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
    Signed-off-by: default avatarVasily Gorbik <gor@linux.ibm.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    1f5dcaa9
qdio_thinint.c 6.61 KB