summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorMartin Schwidefsky <schwidefsky@de.ibm.com>2014-03-21 15:24:27 +0100
committerMartin Schwidefsky <schwidefsky@de.ibm.com>2014-04-01 09:23:36 +0200
commitbd1cb5de140d844f63389bf21b336c194a8c83a1 (patch)
treebf9d6e30ce80c0cf8f82d70903dff29fbf328822 /drivers
parent0ccc8b7ac86053388e793bad20bd26bd777752eb (diff)
downloadlinux-bd1cb5de140d844f63389bf21b336c194a8c83a1.tar.bz2
s390/3270: fix crash with multiple reset device requests
If the 3270 device is detached the initial reset device request will stays pending until the device is operational. A second reset device call will reuse the same request structure which will cause an oops. Add a check to see if the reset device request is already pending and do nothing in this case. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/s390/char/raw3270.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 9f849df4381e..15b3459f8656 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -632,6 +632,8 @@ raw3270_reset_device_cb(struct raw3270_request *rq, void *data)
raw3270_size_device_done(rp);
} else
raw3270_writesf_readpart(rp);
+ memset(&rp->init_reset, 0, sizeof(rp->init_reset));
+ memset(&rp->init_data, 0, sizeof(rp->init_data));
}
static int
@@ -639,9 +641,10 @@ __raw3270_reset_device(struct raw3270 *rp)
{
int rc;
+ /* Check if reset is already pending */
+ if (rp->init_reset.view)
+ return -EBUSY;
/* Store reset data stream to init_data/init_reset */
- memset(&rp->init_reset, 0, sizeof(rp->init_reset));
- memset(&rp->init_data, 0, sizeof(rp->init_data));
rp->init_data[0] = TW_KR;
rp->init_reset.ccw.cmd_code = TC_EWRITEA;
rp->init_reset.ccw.flags = CCW_FLAG_SLI;
@@ -850,7 +853,7 @@ raw3270_create_device(struct ccw_device *cdev)
char *ascebc;
int rc;
- rp = kmalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA);
+ rp = kzalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA);
if (!rp)
return ERR_PTR(-ENOMEM);
ascebc = kmalloc(256, GFP_KERNEL);