s390/dasd: fix use after free in dasd path handling
authorStefan Haberland <sth@linux.ibm.com>
Wed, 4 Aug 2021 15:18:00 +0000 (17:18 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 12 Aug 2021 11:32:23 +0000 (13:32 +0200)
commit642ffd390d67fea23a3ab463e92bc1fbcdef0fa5
tree8ed1a260b84b4970ca45a30b8ea2c777046fb141
parent6ed983ea4a12a95c5e8845354a66d6f866d8cc76
s390/dasd: fix use after free in dasd path handling

commit 952835edb4fdad49361d5330da918be8b765b787 upstream.

When new configuration data is obtained after a path event it is stored
in the per path array. The old data needs to be freed.
The first valid configuration data is also referenced in the device
private structure to identify the device.
When the old per path configuration data was freed the device still
pointed to the already freed data leading to a use after free.

Fix by replacing also the device configuration data with the newly
obtained one before the old data gets freed.

Fixes: 460181217a24 ("s390/dasd: Store path configuration data during path handling")
Cc: stable@vger.kernel.org # 5.11+
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20210804151800.4031761-2-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/s390/block/dasd_eckd.c