diff options
| author |   Julian Wiedmann <jwi@linux.ibm.com> | 2019-11-14 11:19:18 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2019-11-14 18:16:51 -0800 |
| commit | 8311c7a252e82f000077ae0612fc4843b078f980 (patch) | |
| tree | 72d10eaa6ab79656518f9554caa8a804044ad3ba /drivers/s390/net/qeth_core_main.c | |
| parent | s390/qeth: handle skb allocation error gracefully (diff) | |
| download | linux-dev-8311c7a252e82f000077ae0612fc4843b078f980.tar.xz linux-dev-8311c7a252e82f000077ae0612fc4843b078f980.zip | |
s390/qeth: clean up error path in qeth_core_probe_device()
qeth_core_free_card() is meant to be the counterpart of
qeth_alloc_card() - but unfortunately was also picked as the place
to free the QDIO queues.
This gets messy when qeth_core_probe_device() fails during
qeth_add_dbf_entry(). At this point the card->qdio.state is not initialized
yet, so qeth_free_qdio_queues() ends up operating on uninitialized data.
Luckily for now, the whole qeth_card struct is zero-allocated and the value
of the QETH_QDIO_UNINITIALIZED enum is 0 as well. So there's no real impact
from this bug at the moment, it's just really fragile.
Clean this up by moving the qeth_free_qdio_queues() call up one level in
the hierarchy. This way it doesn't get called from the error path.
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | drivers/s390/net/qeth_core_main.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index 08185f76a727..f1f56e354516 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -4855,7 +4855,6 @@ static void qeth_core_free_card(struct qeth_card *card) qeth_clean_channel(&card->data); qeth_put_cmd(card->read_cmd); destroy_workqueue(card->event_wq); - qeth_free_qdio_queues(card); unregister_service_level(&card->qeth_service_level); dev_set_drvdata(&card->gdev->dev, NULL); kfree(card); @@ -5768,6 +5767,8 @@ static void qeth_core_remove_device(struct ccwgroup_device *gdev) qeth_core_free_discipline(card); } + qeth_free_qdio_queues(card); + free_netdev(card->dev); qeth_core_free_card(card); put_device(&gdev->dev); |