Commit b1896543ce59 for kernel

commit b1896543ce59c4258625a35cf41e23a9a1f80ea2
Author: Alexandra Winter <wintera@linux.ibm.com>
Date:   Wed Aug 5 15:10:43 2026 +0200

    s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

    A ism interrupt handler can be active in parallel with ism_dev_exit(),
    accessing freed data structures.

    No new interrupts will be generated after unregister_ieq(). Drain ongoing
    interrupt handlers by free_irq(), before freeing ism data structures.

    Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory")
    Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
    Link: https://patch.msgid.link/20260805131043.954639-1-wintera@linux.ibm.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index d99c588d3e00..242da20f27e0 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -148,13 +148,16 @@ static int unregister_sba(struct ism_dev *ism)
 	if (ret && ret != ISM_ERROR)
 		return -EIO;

+	return 0;
+}
+
+static void ism_free_sba(struct ism_dev *ism)
+{
 	dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
 			  ism->sba, ism->sba_dma_addr);

 	ism->sba = NULL;
 	ism->sba_dma_addr = 0;
-
-	return 0;
 }

 static int unregister_ieq(struct ism_dev *ism)
@@ -168,13 +171,16 @@ static int unregister_ieq(struct ism_dev *ism)
 	if (ret && ret != ISM_ERROR)
 		return -EIO;

+	return 0;
+}
+
+static void ism_free_ieq(struct ism_dev *ism)
+{
 	dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
 			  ism->ieq, ism->ieq_dma_addr);

 	ism->ieq = NULL;
 	ism->ieq_dma_addr = 0;
-
-	return 0;
 }

 static int ism_read_local_gid(struct dibs_dev *dibs)
@@ -573,6 +579,7 @@ static int ism_dev_init(struct ism_dev *ism)

 unreg_sba:
 	unregister_sba(ism);
+	ism_free_sba(ism);
 free_irq:
 	free_irq(pci_irq_vector(pdev, 0), ism);
 free_vectors:
@@ -585,9 +592,13 @@ static void ism_dev_exit(struct ism_dev *ism)
 {
 	struct pci_dev *pdev = ism->pdev;

+	/* ism will only generate new IRQs while ieq & sba are registered */
 	unregister_ieq(ism);
 	unregister_sba(ism);
+	/* drain ongoing irpt handlers */
 	free_irq(pci_irq_vector(pdev, 0), ism);
+	ism_free_ieq(ism);
+	ism_free_sba(ism);
 	pci_free_irq_vectors(pdev);
 }