diff options
| author | Aswin Karuvally <aswin@linux.ibm.com> | 2026-08-27 08:34:08 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-01 16:55:04 -0700 |
| commit | b264d8422779d69febce914efc47a92a85cc382c (patch) | |
| tree | 0b9193a691ddf1ee83a0d6ce612a7b7bb46e9ba1 | |
| parent | 1d2929d0850fff683b8aff051275945e65f082c8 (diff) | |
| download | linux-b264d8422779d69febce914efc47a92a85cc382c.tar.gz linux-b264d8422779d69febce914efc47a92a85cc382c.zip | |
s390/ctcm: Prevent XID null dereference
The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
to signal XID validation error. If peer XID is NULL or r/w channel
pairing mismatch happens, grp->saved_xid2 is never initialized. An
attempt to set the flag in such case leads to NULL dereference.
Fix this by using the always available priv->xid->xid2_flag2 instead of
grp->saved_xid2->xid2_flag2 for validation errors.
Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Link: https://patch.msgid.link/20260827063408.2168914-1-aswin@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/s390/net/ctcm_mpc.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c index 08e36685e578..61c88fe853c5 100644 --- a/drivers/s390/net/ctcm_mpc.c +++ b/drivers/s390/net/ctcm_mpc.c @@ -826,7 +826,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg) fsm_deltimer(&grp->timer); - if (grp->saved_xid2->xid2_flag2 == 0x40) { + if (priv->xid->xid2_flag2 == 0x40) { priv->xid->xid2_flag2 = 0x00; if (grp->estconnfunc) { grp->estconnfunc(grp->port_num, 1, @@ -1636,7 +1636,6 @@ done: "The XID used in the MPC protocol is not valid, " "rc = %d\n", rc); priv->xid->xid2_flag2 = 0x40; - grp->saved_xid2->xid2_flag2 = 0x40; } return rc; |