]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commitdiff
s390/qeth: cancel close_dev work before removing a card
authorJulian Wiedmann <jwi@linux.ibm.com>
Mon, 4 Feb 2019 16:40:08 +0000 (17:40 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 4 Feb 2019 17:43:48 +0000 (09:43 -0800)
A card's close_dev work is scheduled on a driver-wide workqueue. If the
card is removed and freed while the work is still active, this causes a
use-after-free.
So make sure that the work is completed before freeing the card.

Fixes: 0f54761d167f ("qeth: Support VEPA mode")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/s390/net/qeth_core.h
drivers/s390/net/qeth_l2_main.c
drivers/s390/net/qeth_l3_main.c

index 0ee026947f209941ace51b0ff8a476885e46b048..1cf45ace0dd0b28ba6204f3139ec4f0c089a46b3 100644 (file)
@@ -22,6 +22,7 @@
 #include <linux/hashtable.h>
 #include <linux/ip.h>
 #include <linux/refcount.h>
+#include <linux/workqueue.h>
 
 #include <net/ipv6.h>
 #include <net/if_inet6.h>
index f108d4b44605805b3430a7fc7890340645b92146..9fec0117fc0091dc8c27dadcda1fb9e1cbf4f36b 100644 (file)
@@ -801,6 +801,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 
        if (cgdev->state == CCWGROUP_ONLINE)
                qeth_l2_set_offline(cgdev);
+
+       cancel_work_sync(&card->close_dev_work);
        if (qeth_netdev_is_registered(card->dev))
                unregister_netdev(card->dev);
 }
index 42a7cdc59b76af1a8e220f4097a16702a950cab9..5e810561cb1247884d5d5b455a02c1ed8cae7675 100644 (file)
@@ -2338,6 +2338,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
        if (cgdev->state == CCWGROUP_ONLINE)
                qeth_l3_set_offline(cgdev);
 
+       cancel_work_sync(&card->close_dev_work);
        if (qeth_netdev_is_registered(card->dev))
                unregister_netdev(card->dev);
        qeth_l3_clear_ip_htable(card, 0);