Description
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues.
Product status
e5dcf0025d7af58f525590ac86ac27cb44714e8d (git) before abb6e07f46a740cda4f07d1b561ae4eaa7a1df42
e5dcf0025d7af58f525590ac86ac27cb44714e8d (git) before f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424
e5dcf0025d7af58f525590ac86ac27cb44714e8d (git) before 6715560527e343a387e4a0d2e6c401748e89fa55
e5dcf0025d7af58f525590ac86ac27cb44714e8d (git) before c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603
e5dcf0025d7af58f525590ac86ac27cb44714e8d (git) before f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7
3.10
Any version before 3.10
6.6.128 (semver)
6.12.75 (semver)
6.18.14 (semver)
6.19.4 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42
git.kernel.org/...c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424
git.kernel.org/...c/6715560527e343a387e4a0d2e6c401748e89fa55
git.kernel.org/...c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603
git.kernel.org/...c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7