]> git.baikalelectronics.ru Git - kernel.git/commit
s390/dasd: fix use after free in dasd path handling
authorStefan Haberland <sth@linux.ibm.com>
Wed, 4 Aug 2021 15:18:00 +0000 (17:18 +0200)
committerJens Axboe <axboe@kernel.dk>
Wed, 4 Aug 2021 15:20:11 +0000 (09:20 -0600)
commit987532b6d7213b5df06334a34dc67c892664bb46
tree35cc36238f638738be44ffa303d3b815a3cb5c84
parent0b74111fcae09687a8228fec9f383cecb34fe1b0
s390/dasd: fix use after free in dasd path handling

When new configuration data is obtained after a path event it is stored
in the per path array. The old data needs to be freed.
The first valid configuration data is also referenced in the device
private structure to identify the device.
When the old per path configuration data was freed the device still
pointed to the already freed data leading to a use after free.

Fix by replacing also the device configuration data with the newly
obtained one before the old data gets freed.

Fixes: 0777f92bd901 ("s390/dasd: Store path configuration data during path handling")
Cc: stable@vger.kernel.org # 5.11+
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20210804151800.4031761-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/s390/block/dasd_eckd.c