kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/s390
History
Julian Wiedmann 528f95c4f7 s390/qeth: don't clobber buffer on async TX completion 
commit ce28867fd2 upstream.

If qeth_qdio_output_handler() detects that a transmit requires async
completion, it replaces the pending buffer's metadata object
(qeth_qdio_out_buffer) so that this queue buffer can be re-used while
the data is pending completion.

Later when the CQ indicates async completion of such a metadata object,
qeth_qdio_cq_handler() tries to free any data associated with this
object (since HW has now completed the transfer). By calling
qeth_clear_output_buffer(), it erronously operates on the queue buffer
that _previously_ belonged to this transfer ... but which has been
potentially re-used several times by now.
This results in double-free's of the buffer's data, and failing
transmits as the buffer descriptor is scrubbed in mid-air.

The correct way of handling this situation is to
1. scrub the queue buffer when it is prepared for re-use, and
2. later obtain the data addresses from the async-completion notifier
   (ie. the AOB), instead of the queue buffer.

All this only affects qeth devices used for af_iucv HiperTransport.

Fixes: 0da9581ddb ("qeth: exploit asynchronous delivery of storage blocks")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-11-20 18:05:31 +00:00
..
block s390/dasd: fix IO error for newly defined devices 2018-10-21 08:45:36 +01:00
char s390/vmlogrdr: fix IUCV buffer allocation 2017-03-16 02:26:34 +00:00
cio s390/qdio: don't release memory in qdio_setup_irq() 2018-10-21 08:46:09 +01:00
crypto crypto: prefix module autoloading with "crypto-" 2015-02-04 10:57:48 +00:00
kvm KVM: s390: virtio-ccw: don't overwrite config space values 2015-07-15 10:01:12 +01:00
net s390/qeth: don't clobber buffer on async TX completion 2018-11-20 18:05:31 +00:00
scsi scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread 2018-11-20 18:04:58 +00:00
Makefile [S390] split/move machine check handler code 2009-03-26 15:24:10 +01:00