s390/cio: fix unlocked access of online member

Make sure that access to the online member of a ccw device is
guarded by the ccwlock.

Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

1 files changed, 9 insertions, 4 deletions

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e4a7ab2bb629..4a0734fcc83c 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -333,9 +333,9 @@ int ccw_device_set_offline(struct ccw_device *cdev)
                 if (ret != 0)
                         return ret;
         }
-        cdev->online = 0;
         spin_lock_irq(cdev->ccwlock);
         sch = to_subchannel(cdev->dev.parent);
+        cdev->online = 0;
         /* Wait until a final state or DISCONNECTED is reached */
         while (!dev_fsm_final_state(cdev) &&
                cdev->private->state != DEV_STATE_DISCONNECTED) {
@@ -446,7 +446,10 @@ int ccw_device_set_online(struct ccw_device *cdev)
                 ret = cdev->drv->set_online(cdev);
         if (ret)
                 goto rollback;
+
+        spin_lock_irq(cdev->ccwlock);
         cdev->online = 1;
+        spin_unlock_irq(cdev->ccwlock);
         return 0;
 
 rollback:
@@ -1745,8 +1748,7 @@ ccw_device_probe (struct device *dev)
         return 0;
 }
 
-static int
-ccw_device_remove (struct device *dev)
+static int ccw_device_remove(struct device *dev)
 {
         struct ccw_device *cdev = to_ccwdev(dev);
         struct ccw_driver *cdrv = cdev->drv;
@@ -1754,9 +1756,10 @@ ccw_device_remove (struct device *dev)
 
         if (cdrv->remove)
                 cdrv->remove(cdev);
+
+        spin_lock_irq(cdev->ccwlock);
         if (cdev->online) {
                 cdev->online = 0;
-                spin_lock_irq(cdev->ccwlock);
                 ret = ccw_device_offline(cdev);
                 spin_unlock_irq(cdev->ccwlock);
                 if (ret == 0)
@@ -1769,10 +1772,12 @@ ccw_device_remove (struct device *dev)
                                       cdev->private->dev_id.devno);
                 /* Give up reference obtained in ccw_device_set_online(). */
                 put_device(&cdev->dev);
+                spin_lock_irq(cdev->ccwlock);
         }
         ccw_device_set_timeout(cdev, 0);
         cdev->drv = NULL;
         cdev->private->int_class = IRQIO_CIO;
+        spin_unlock_irq(cdev->ccwlock);
         return 0;
 }