On 10/28/26 6:46 PM, Farhan Ali wrote:
> On an SCLP deconfigure we don't clean up the FMB timer. If there is a
> pending unplug request then we can destroy the S390PCIBusDevice object
> without correctly cleaning up the timer. So fmb_update() will then run on
> freed memory. Clean up the FMB timer before we destroy the S390PCIBusDevice
> object to prevent this use after free.
>
> When FMB was introduced with commit 6e92c70c37 ("s390x/pci: add common
> function measurement block") we originally cleaned up the FMB timer in
> s390_pcihost_unplug(). This behavior was changed in the re-work done with
> commit e0998fe89104 ("s390x/pci: Introduce unplug requests and split unplug
> handler").
>
> Fixes: e0998fe89104 ("s390x/pci: Introduce unplug requests and split unplug
> handler")
> Cc: [email protected]
> Signed-off-by: Farhan Ali <[email protected]>
Reviewed-by: Matthew Rosato <[email protected]>
