* [PATCH net] s390/ism: folio_put() after error
@ 2026-09-02 14:37 Alexandra Winter
2026-09-02 16:58 ` Gerd Bayer
0 siblings, 1 reply; 2+ messages in thread
From: Alexandra Winter @ 2026-09-02 14:37 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni, Eric Dumazet,
Andrew Lunn, Gerd Bayer, Aswin Karuvally
Cc: netdev, linux-s390, linux-kernel, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev, Christian Borntraeger, Sven Schnelle,
Simon Horman
dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of
kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator
corruption.
While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF
by future callers.
Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
---
drivers/s390/net/ism_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index 242da20f27e0..035b233abb4e 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -231,6 +231,7 @@ static void ism_free_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
dma_unmap_page(&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len,
DMA_FROM_DEVICE);
folio_put(virt_to_folio(dmb->cpu_addr));
+ dmb->cpu_addr = NULL;
}
static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
@@ -274,7 +275,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
return 0;
out_free:
- kfree(dmb->cpu_addr);
+ folio_put(folio);
+ dmb->cpu_addr = NULL;
out_bit:
clear_bit(dmb->idx, ism->sba_bitmap);
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net] s390/ism: folio_put() after error
2026-09-02 14:37 [PATCH net] s390/ism: folio_put() after error Alexandra Winter
@ 2026-09-02 16:58 ` Gerd Bayer
0 siblings, 0 replies; 2+ messages in thread
From: Gerd Bayer @ 2026-09-02 16:58 UTC (permalink / raw)
To: Alexandra Winter, David Miller, Jakub Kicinski, Paolo Abeni,
Eric Dumazet, Andrew Lunn, Aswin Karuvally
Cc: netdev, linux-s390, linux-kernel, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev, Christian Borntraeger, Sven Schnelle,
Simon Horman
On Wed, 2026-09-02 at 16:37 +0200, Alexandra Winter wrote:
> dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of
> kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator
> corruption.
>
> While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF
> by future callers.
>
> Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")
> Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
> ---
> drivers/s390/net/ism_drv.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
> index 242da20f27e0..035b233abb4e 100644
> --- a/drivers/s390/net/ism_drv.c
> +++ b/drivers/s390/net/ism_drv.c
> @@ -231,6 +231,7 @@ static void ism_free_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
> dma_unmap_page(&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len,
> DMA_FROM_DEVICE);
> folio_put(virt_to_folio(dmb->cpu_addr));
> + dmb->cpu_addr = NULL;
> }
>
> static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
> @@ -274,7 +275,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
> return 0;
>
> out_free:
> - kfree(dmb->cpu_addr);
> + folio_put(folio);
> + dmb->cpu_addr = NULL;
> out_bit:
> clear_bit(dmb->idx, ism->sba_bitmap);
> return rc;
Hi Alexandra,
thank you for catching and addressing these flaws in my patch. Feel
free to accept my
Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
Thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-02 16:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-02 14:37 [PATCH net] s390/ism: folio_put() after error Alexandra Winter
2026-09-02 16:58 ` Gerd Bayer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox