diff options
| author | Julian Wiedmann <jwi@linux.ibm.com> | 2018-05-02 08:48:43 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-22 18:53:59 +0200 |
| commit | c568bdf37b6ecf37aa5823f8845c3ecf07f19ab3 (patch) | |
| tree | a0cd8bb0f2b75c4ad81b55e4c0065f1bd30555b9 /drivers | |
| parent | e2266ea100ea54556c0524a7763a844f7c4eca17 (diff) | |
| download | linux-exynos-c568bdf37b6ecf37aa5823f8845c3ecf07f19ab3.tar.gz linux-exynos-c568bdf37b6ecf37aa5823f8845c3ecf07f19ab3.tar.bz2 linux-exynos-c568bdf37b6ecf37aa5823f8845c3ecf07f19ab3.zip | |
s390/qdio: fix access to uninitialized qdio_q fields
commit e521813468f786271a87e78e8644243bead48fad upstream.
Ever since CQ/QAOB support was added, calling qdio_free() straight after
qdio_alloc() results in qdio_release_memory() accessing uninitialized
memory (ie. q->u.out.use_cq and q->u.out.aobs). Followed by a
kmem_cache_free() on the random AOB addresses.
For older kernels that don't have 6e30c549f6ca, the same applies if
qdio_establish() fails in the DEV_STATE_ONLINE check.
While initializing q->u.out.use_cq would be enough to fix this
particular bug, the more future-proof change is to just zero-alloc the
whole struct.
Fixes: 104ea556ee7f ("qdio: support asynchronous delivery of storage blocks")
Cc: <stable@vger.kernel.org> #v3.2+
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/s390/cio/qdio_setup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c index 48b3866a9ded..3da5f3f3cf8b 100644 --- a/drivers/s390/cio/qdio_setup.c +++ b/drivers/s390/cio/qdio_setup.c @@ -140,7 +140,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues) int i; for (i = 0; i < nr_queues; i++) { - q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL); + q = kmem_cache_zalloc(qdio_q_cache, GFP_KERNEL); if (!q) return -ENOMEM; |