Commit f014824e authored by Sebastian Ott's avatar Sebastian Ott Committed by Martin Schwidefsky

[S390] cio: fix use after free in s390 debug feature

When using s390dbf with "%s" in sprintf format strings the string itself
is not copied to the dbf buffer.
Since in this case only pointers are stored in the s390dbf, we should
not use dev_name - which is bound to the lifetime of the device.
Reading this entry from s390dbf after the device was released will cause
an use after free error.
Signed-off-by: default avatarSebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 3f09bb89
...@@ -2038,7 +2038,9 @@ static void __ccw_device_pm_restore(struct ccw_device *cdev) ...@@ -2038,7 +2038,9 @@ static void __ccw_device_pm_restore(struct ccw_device *cdev)
spin_unlock_irq(sch->lock); spin_unlock_irq(sch->lock);
if (ret) { if (ret) {
CIO_MSG_EVENT(0, "Couldn't start recognition for device " CIO_MSG_EVENT(0, "Couldn't start recognition for device "
"%s (ret=%d)\n", dev_name(&cdev->dev), ret); "0.%x.%04x (ret=%d)\n",
cdev->private->dev_id.ssid,
cdev->private->dev_id.devno, ret);
spin_lock_irq(sch->lock); spin_lock_irq(sch->lock);
cdev->private->state = DEV_STATE_DISCONNECTED; cdev->private->state = DEV_STATE_DISCONNECTED;
spin_unlock_irq(sch->lock); spin_unlock_irq(sch->lock);
...@@ -2101,8 +2103,9 @@ static int ccw_device_pm_restore(struct device *dev) ...@@ -2101,8 +2103,9 @@ static int ccw_device_pm_restore(struct device *dev)
} }
/* check if the device id has changed */ /* check if the device id has changed */
if (sch->schib.pmcw.dev != cdev->private->dev_id.devno) { if (sch->schib.pmcw.dev != cdev->private->dev_id.devno) {
CIO_MSG_EVENT(0, "resume: sch %s: failed (devno changed from " CIO_MSG_EVENT(0, "resume: sch 0.%x.%04x: failed (devno "
"%04x to %04x)\n", dev_name(&sch->dev), "changed from %04x to %04x)\n",
sch->schid.ssid, sch->schid.sch_no,
cdev->private->dev_id.devno, cdev->private->dev_id.devno,
sch->schib.pmcw.dev); sch->schib.pmcw.dev);
goto out_unreg_unlock; goto out_unreg_unlock;
...@@ -2135,8 +2138,9 @@ static int ccw_device_pm_restore(struct device *dev) ...@@ -2135,8 +2138,9 @@ static int ccw_device_pm_restore(struct device *dev)
if (cm_enabled) { if (cm_enabled) {
ret = ccw_set_cmf(cdev, 1); ret = ccw_set_cmf(cdev, 1);
if (ret) { if (ret) {
CIO_MSG_EVENT(2, "resume: cdev %s: cmf failed " CIO_MSG_EVENT(2, "resume: cdev 0.%x.%04x: cmf failed "
"(rc=%d)\n", dev_name(&cdev->dev), ret); "(rc=%d)\n", cdev->private->dev_id.ssid,
cdev->private->dev_id.devno, ret);
ret = 0; ret = 0;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment