]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
authorAlexandra Winter <wintera@linux.ibm.com>
Wed, 5 Aug 2026 13:10:43 +0000 (15:10 +0200)
committerJakub Kicinski <kuba@kernel.org>
Thu, 6 Aug 2026 16:28:33 +0000 (09:28 -0700)
commitb1896543ce59c4258625a35cf41e23a9a1f80ea2
tree0131e6611fef0d1fc2c364003927c214579b7cc8
parent4be5b041e679cbae7fdc22781888ba08df7f27bf
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

A ism interrupt handler can be active in parallel with ism_dev_exit(),
accessing freed data structures.

No new interrupts will be generated after unregister_ieq(). Drain ongoing
interrupt handlers by free_irq(), before freeing ism data structures.

Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260805131043.954639-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/s390/net/ism_drv.c