From b2403e2e276f81ae98cc44da860404cc470a1b7f Mon Sep 17 00:00:00 2001 From: Alexandra Winter Date: Wed, 5 Aug 2026 15:10:43 +0200 Subject: [PATCH] s390/ism: Fix UAF of sba and ieq during ism_dev_exit() ANBZ: #44435 commit b1896543ce59c4258625a35cf41e23a9a1f80ea2 upstream. A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures. [backport-note] PatchPilot-Conflict-Type: context_drift, divergent_fix Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory") Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20260805131043.954639-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski Fixes: CVE-2026-74690 Assisted-by: PatchPilot Signed-off-by: Xunlei Pang --- drivers/s390/net/ism_drv.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c index 7fb4bb2c0b91..ce1a174254cd 100644 --- a/drivers/s390/net/ism_drv.c +++ b/drivers/s390/net/ism_drv.c @@ -228,13 +228,16 @@ static int unregister_sba(struct ism_dev *ism) if (ret && ret != ISM_ERROR) return -EIO; + return 0; +} + +static void ism_free_sba(struct ism_dev *ism) +{ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE, ism->sba, ism->sba_dma_addr); ism->sba = NULL; ism->sba_dma_addr = 0; - - return 0; } static int unregister_ieq(struct ism_dev *ism) @@ -248,13 +251,16 @@ static int unregister_ieq(struct ism_dev *ism) if (ret && ret != ISM_ERROR) return -EIO; + return 0; +} + +static void ism_free_ieq(struct ism_dev *ism) +{ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE, ism->ieq, ism->ieq_dma_addr); ism->ieq = NULL; ism->ieq_dma_addr = 0; - - return 0; } static int ism_read_local_gid(struct ism_dev *ism) @@ -625,6 +631,7 @@ static int ism_dev_init(struct ism_dev *ism) unregister_ieq(ism); unreg_sba: unregister_sba(ism); + ism_free_sba(ism); free_irq: free_irq(pci_irq_vector(pdev, 0), ism); free_client_arr: @@ -725,9 +732,13 @@ static void ism_dev_exit(struct ism_dev *ism) if (SYSTEM_EID.serial_number[0] != '0' || SYSTEM_EID.type[0] != '0') ism_del_vlan_id(ism, ISM_RESERVED_VLANID); + /* ism will only generate new IRQs while ieq & sba are registered */ unregister_ieq(ism); unregister_sba(ism); + /* drain ongoing irpt handlers */ free_irq(pci_irq_vector(pdev, 0), ism); + ism_free_ieq(ism); + ism_free_sba(ism); kfree(ism->sba_client_arr); pci_free_irq_vectors(pdev); list_del_init(&ism->list); -- Gitee