• Julian Wiedmann's avatar
    s390/qdio: fix access to uninitialized qdio_q fields · e5218134
    Julian Wiedmann authored
    Ever since CQ/QAOB support was added, calling qdio_free() straight after
    qdio_alloc() results in qdio_release_memory() accessing uninitialized
    memory (ie. q->u.out.use_cq and q->u.out.aobs). Followed by a
    kmem_cache_free() on the random AOB addresses.
    
    For older kernels that don't have 6e30c549, the same applies if
    qdio_establish() fails in the DEV_STATE_ONLINE check.
    
    While initializing q->u.out.use_cq would be enough to fix this
    particular bug, the more future-proof change is to just zero-alloc the
    whole struct.
    
    Fixes: 104ea556 ("qdio: support asynchronous delivery of storage blocks")
    Cc: <stable@vger.kernel.org> #v3.2+
    Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
    Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
    e5218134
qdio_setup.c 15.3 KB