diff options
| author | Julian Wiedmann <jwi@linux.ibm.com> | 2018-07-11 17:42:39 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-07-12 16:42:39 -0700 |
| commit | f67a43a73b543f686577507fe9ccdfae212b9924 (patch) | |
| tree | 54b107300a11ba600a63a428a253363d9f977a7a /drivers/s390/net/qeth_core.h | |
| parent | 3b346c18149674ee40dea5281c8644a572ef3fb1 (diff) | |
s390/qeth: remove unused buffer->aob pointer
Except for tracing, the pointer is not used.
At the same time, accessing it from qeth_qdio_output_handler() is racy:
whenever qeth_qdio_cq_handler() gets control, its call to
qeth_qdio_handle_aob() frees the AOB.
So the AOB pointer that qeth_qdio_output_handler() stores into 'buffer'
can go stale at any time, and trigger a use-after-free.
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390/net/qeth_core.h')
| -rw-r--r-- | drivers/s390/net/qeth_core.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h index a246a618f9a4..0ca6ea319d88 100644 --- a/drivers/s390/net/qeth_core.h +++ b/drivers/s390/net/qeth_core.h @@ -465,7 +465,6 @@ struct qeth_qdio_out_buffer { struct sk_buff_head skb_list; int is_header[QDIO_MAX_ELEMENTS_PER_BUFFER]; - struct qaob *aob; struct qeth_qdio_out_q *q; struct qeth_qdio_out_buffer *next_pending; }; |