s390/cio: invalidate cdev pointer before deregistration

Make sure that the cdev pointer for IO subchannels is set to NULL when
we deregister the device (and release its last reference). This will
fix a bug were another process operates on an already freed ccw device.

Acked-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e8e1a108cdf8..fc916f5d7314 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1521,11 +1521,14 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                         goto out;
                 break;
         case IO_SCH_UNREG_ATTACH:
+                spin_lock_irqsave(sch->lock, flags);
                 if (cdev->private->flags.resuming) {
                         /* Device will be handled later. */
                         rc = 0;
-                        goto out;
+                        goto out_unlock;
                 }
+                sch_set_cdev(sch, NULL);
+                spin_unlock_irqrestore(sch->lock, flags);
                 /* Unregister ccw device. */
                 ccw_device_unregister(cdev);
                 break;