]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
s390/qeth: fix use-after-free in error path
authorJulian Wiedmann <jwi@linux.ibm.com>
Mon, 4 Feb 2019 16:40:07 +0000 (17:40 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 Mar 2019 21:04:15 +0000 (14:04 -0700)
commit1724634efde9d8b6e55ab8c53780115869cd585a
treef87bc7b6cd27ce06bbdf50b5f8d2ef0b18ca65c6
parent04e31d96e5e23d92217ecdea3870cb7e07364989
s390/qeth: fix use-after-free in error path

[ Upstream commit afa0c5904ba16d59b0454f7ee4c807dae350f432 ]

The error path in qeth_alloc_qdio_buffers() that takes care of
cleaning up the Output Queues is buggy. It first frees the queue, but
then calls qeth_clear_outq_buffers() with that very queue struct.

Make the call to qeth_clear_outq_buffers() part of the free action
(in the correct order), and while at it fix the naming of the helper.

Fixes: 0da9581ddb0f ("qeth: exploit asynchronous delivery of storage blocks")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/s390/net/qeth_core_main.c