Commit 8311c7a2 authored Nov 14, 2019 by Julian Wiedmann Committed by David S. Miller Nov 14, 2019

s390/qeth: clean up error path in qeth_core_probe_device()

qeth_core_free_card() is meant to be the counterpart of
qeth_alloc_card() - but unfortunately was also picked as the place
to free the QDIO queues.

This gets messy when qeth_core_probe_device() fails during
qeth_add_dbf_entry(). At this point the card->qdio.state is not initialized
yet, so qeth_free_qdio_queues() ends up operating on uninitialized data.

Luckily for now, the whole qeth_card struct is zero-allocated and the value
of the QETH_QDIO_UNINITIALIZED enum is 0 as well. So there's no real impact
from this bug at the moment, it's just really fragile.

Clean this up by moving the qeth_free_qdio_queues() call up one level in
the hierarchy. This way it doesn't get called from the error path.

Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 17caeaa4

drivers/s390/net/qeth_core_main.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4855,7 +4855,6 @@ static void qeth_core_free_card(struct qeth_card *card)
		qeth_clean_channel(&card->data);
		qeth_put_cmd(card->read_cmd);
		destroy_workqueue(card->event_wq);
		qeth_free_qdio_queues(card);
		unregister_service_level(&card->qeth_service_level);
		dev_set_drvdata(&card->gdev->dev, NULL);
		kfree(card);
		@@ -5768,6 +5767,8 @@ static void qeth_core_remove_device(struct ccwgroup_device *gdev)
		qeth_core_free_discipline(card);
		}

		qeth_free_qdio_queues(card);

		free_netdev(card->dev);
		qeth_core_free_card(card);
		put_device(&gdev->dev);

Admin message