History

s390/ism: folio_put() after error

dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator corruption. While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF by future callers.

Alexandra Winter committed 2 months ago

Commit 907a56a1 parent 1668a311 file · +3 −1Browse files

Unified · Split

drivers/s390/net/ism_drv.c+3−1
@@ -231,6 +231,7 @@ static void ism_free_dmb(struct ism_dev *ism, struct dibs_dmb *dmb) · 230 unmodified lines
231 dma_unmap_page(&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len,231 dma_unmap_page(&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len,
232 DMA_FROM_DEVICE);232 DMA_FROM_DEVICE);
233 folio_put(virt_to_folio(dmb->cpu_addr));233 folio_put(virt_to_folio(dmb->cpu_addr));
234 dmb->cpu_addr = NULL;
234}235}
235 236
236static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)237static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
@@ -274,7 +275,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb) · 37 unmodified lines
274 return 0;275 return 0;
275 276
276out_free:277out_free:
277 kfree(dmb->cpu_addr);278 folio_put(folio);
279 dmb->cpu_addr = NULL;
278out_bit:280out_bit:
279 clear_bit(dmb->idx, ism->sba_bitmap);281 clear_bit(dmb->idx, ism->sba_bitmap);
280 return rc;282 return rc;