linux/drivers/s390
Eric Farman f9bcff2655 s390/vfio_ccw: Free all memory if cp_init() fails
[ Upstream commit 74186c2968 ]

The routine cp_free() is called to unpin/free any memory once an I/O
is completed successfully, or if cp_prefetch() fails. But if cp_init()
fails, and cp->initialized is not enabled, the same routine cannot be
used to free all the memory.

An attempt to address this exists in ccwchain_handle_ccw(), where a
single call to ccwchain_free() is made for the currently-processed
CCW segment. But this will leak other segments (created as a result
of a Transfer in Channel) that had been allocated as part of the same
channel program.

Address this by performing the cleanup outside of the recursive
ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

Fixes: 8b515be512 ("vfio-ccw: Fix memory leak and don't call cp_free in cp_init")
Cc: stable@vger.kernel.org
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-27 14:28:22 +02:00
..
block s390/dasd: Fix potential NULL pointer dereference 2026-08-19 17:14:11 +02:00
char s390/monwriter: Reject buffer reuse with different data length 2026-07-24 15:51:54 +02:00
cio s390/vfio_ccw: Free all memory if cp_init() fails 2026-08-27 14:28:22 +02:00
crypto s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() 2026-08-19 17:14:12 +02:00
net s390/qeth: validate user buffer length in SNMP and ARP query ioctls 2026-08-23 14:17:15 +02:00
scsi scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req 2026-08-19 17:14:08 +02:00
virtio virtio/s390: get rid of open-coded kvm hypercall 2021-06-28 11:18:28 +02:00
Makefile s390: remove pointless drivers-y in drivers/s390/Makefile 2019-09-16 13:21:51 +02:00