diff options
| author | Julian Wiedmann <jwi@linux.ibm.com> | 2020-12-07 16:12:33 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-12-07 17:55:21 +0300 |
| commit | d2e46004c5cdaec4befa3c1a071bb9fa7fdbbcc5 (patch) | |
| tree | 3019f0d8060ed4c98306ee325767ec6f369bb031 /drivers/s390 | |
| parent | 75cf3854dcdf7b5c583538cae12ffa054d237d93 (diff) | |
| download | linux-d2e46004c5cdaec4befa3c1a071bb9fa7fdbbcc5.tar.xz | |
s390/qeth: make qeth_qdio_handle_aob() more robust
When qeth_qdio_handle_aob() frees dangling allocations in the notified
TX buffer, there are rare tear-down cases where
qeth_drain_output_queue() would later call qeth_clear_output_buffer()
for the same buffer - and thus end up walking the buffer a second time
to check for dangling kmem_cache allocations.
Luckily current code previously scrubs such a buffer, so
qeth_clear_output_buffer() would find buf->buffer->element[i].addr as
NULL and not do anything. But this is fragile, and we can easily improve
it by consistently clearing the ->is_header flag after freeing the
allocation.
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/net/qeth_core_main.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index da27ef451d05..f4b60294a969 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -546,6 +546,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, if (data && buffer->is_header[i]) kmem_cache_free(qeth_core_header_cache, data); + buffer->is_header[i] = 0; } atomic_set(&buffer->state, QETH_QDIO_BUF_EMPTY); |