The various indicators pointers allow them to be overwritten, but leak any existing structs that might be there. If indicators exist, ensure that they are released before setting the new ones.
Both the regular and adapter interrupt paths check that they aren't being asked to enable interrupts when the other one is enabled, so just do this release once all the potential checks are completed. Cc: [email protected] Fixes: 7bca3892cb ("s390x/virtio-ccw: reference-counted indicators") Signed-off-by: Eric Farman <[email protected]> --- hw/s390x/virtio-ccw.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index eb6378ea4c..f46f936150 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -582,6 +582,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators); + dev->indicators = NULL; + } indicators = be64_to_cpu(indicators); dev->indicators = get_indicator(indicators, sizeof(uint64_t)); sch->curr_status.scsw.count = ccw.count - sizeof(indicators); @@ -606,6 +611,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators2) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators2); + dev->indicators2 = NULL; + } indicators = be64_to_cpu(indicators); dev->indicators2 = get_indicator(indicators, sizeof(uint64_t)); sch->curr_status.scsw.count = ccw.count - sizeof(indicators); @@ -666,6 +676,17 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else if (thinint.isc > MAX_ISC) { ret = -ENOSYS; } else { + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators); + dev->indicators = NULL; + } + if (dev->summary_indicator) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, + dev->summary_indicator); + dev->summary_indicator = NULL; + } thinint.ind_bit = be64_to_cpu(thinint.ind_bit); thinint.summary_indicator = be64_to_cpu(thinint.summary_indicator); -- 2.53.0
