Re: [PATCH 5.10 022/147] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

Ben Hutchings
2026-03-17T14:17:00Z

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

On Sat, 2026-02-28 at 13:15 -0500, Sasha Levin wrote:
> From: Salah Triki <salah.triki@gmail.com>
>
> [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ]
>
> `css_alloc_subchannel()` calls `device_initialize()` before setting up
> the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,
> the error path frees the subchannel structure directly, bypassing
> the device model reference counting.
>
> Once `device_initialize()` has been called, the embedded struct device
> must be released via `put_device()`, allowing the release callback to
> free the container structure.

But in 5.10, the error path is only used *before* device_initialize()
has been called. So it is absolutely wrong to call put_device().

> Fix the error path by dropping the initial device reference with
> `put_device()` instead of calling `kfree()` directly.
>
> This ensures correct device lifetime handling and avoids potential
> use-after-free or double-free issues.
>
> Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation")
[...]

The bug actually seems to have been introduced in 5.12 by commit
4520a91a976e "s390/cio: use dma helpers for setting masks".

So please revert this for 5.10.

Ben.

--
Ben Hutchings
For every complex problem
there is a solution that is simple, neat, and wrong.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]