s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

A ism interrupt handler can be active in parallel with ism_dev_exit(),
accessing freed data structures.

No new interrupts will be generated after unregister_ieq(). Drain ongoing
interrupt handlers by free_irq(), before freeing ism data structures.

Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260805131043.954639-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index d99c588d3e00ce209be76e6e46d3bd8232a92a37..242da20f27e0eded6aab24ece6eda8cfd163cf73 100644 (file)
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -148,13 +148,16 @@ static int unregister_sba(struct ism_dev *ism)
        if (ret && ret != ISM_ERROR)
                return -EIO;
 
+       return 0;
+}
+
+static void ism_free_sba(struct ism_dev *ism)
+{
        dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
                          ism->sba, ism->sba_dma_addr);
 
        ism->sba = NULL;
        ism->sba_dma_addr = 0;
-
-       return 0;
 }
 
 static int unregister_ieq(struct ism_dev *ism)
@@ -168,13 +171,16 @@ static int unregister_ieq(struct ism_dev *ism)
        if (ret && ret != ISM_ERROR)
                return -EIO;
 
+       return 0;
+}
+
+static void ism_free_ieq(struct ism_dev *ism)
+{
        dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
                          ism->ieq, ism->ieq_dma_addr);
 
        ism->ieq = NULL;
        ism->ieq_dma_addr = 0;
-
-       return 0;
 }
 
 static int ism_read_local_gid(struct dibs_dev *dibs)
@@ -573,6 +579,7 @@ static int ism_dev_init(struct ism_dev *ism)
 
 unreg_sba:
        unregister_sba(ism);
+       ism_free_sba(ism);
 free_irq:
        free_irq(pci_irq_vector(pdev, 0), ism);
 free_vectors:
@@ -585,9 +592,13 @@ static void ism_dev_exit(struct ism_dev *ism)
 {
        struct pci_dev *pdev = ism->pdev;
 
+       /* ism will only generate new IRQs while ieq & sba are registered */
        unregister_ieq(ism);
        unregister_sba(ism);
+       /* drain ongoing irpt handlers */
        free_irq(pci_irq_vector(pdev, 0), ism);
+       ism_free_ieq(ism);
+       ism_free_sba(ism);
        pci_free_irq_vectors(pdev);
 }