diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-07-20 11:07:34 +0400 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2012-07-20 22:34:21 +0400 |
| commit | 2962846d14769e526b5d266f4af998b5a027b1d7 (patch) | |
| tree | 6ccd195cd39b6cbec2ed8f25e38f28ff98fdecf3 | |
| parent | d6dfc868bcf329392abd1ecfa7357eb51ebf8c30 (diff) | |
| download | linux-2962846d14769e526b5d266f4af998b5a027b1d7.tar.xz | |
target: NULL dereference on error path
During a failure in transport_add_device_to_core_hba() code, we called
destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated which leads
to an oops.
This fixes a regression introduced in with:
commit af8772926f019b7bddd7477b8de5f3b0f12bad21
Author: Christoph Hellwig <hch@infradead.org>
Date: Sun Jul 8 15:58:49 2012 -0400
target: replace the processing thread with a TMR work queue
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
| -rw-r--r-- | drivers/target/target_core_transport.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 7647ecafbcc7..0eaae23d12b5 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba( * Setup the Asymmetric Logical Unit Assignment for struct se_device */ if (core_setup_alua(dev, force_pt) < 0) - goto out; + goto err_dev_list; /* * Startup the struct se_device processing thread @@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba( if (!dev->tmr_wq) { pr_err("Unable to create tmr workqueue for %s\n", dev->transport->name); - goto out; + goto err_dev_list; } /* * Setup work_queue for QUEUE_FULL @@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba( if (!inquiry_prod || !inquiry_rev) { pr_err("All non TCM/pSCSI plugins require" " INQUIRY consts\n"); - goto out; + goto err_wq; } strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8); @@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba( scsi_dump_inquiry(dev); return dev; -out: - destroy_workqueue(dev->tmr_wq); +err_wq: + destroy_workqueue(dev->tmr_wq); +err_dev_list: spin_lock(&hba->device_lock); list_del(&dev->dev_list); hba->dev_count--; |