* [patch] target: NULL dereference on error path
@ 2012-07-20 7:07 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2012-07-20 7:07 UTC (permalink / raw)
To: Nicholas A. Bellinger; +Cc: linux-scsi, target-devel, kernel-janitors
We called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated
which leads to an oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7647eca..0eaae23 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
* Setup the Asymmetric Logical Unit Assignment for struct se_device
*/
if (core_setup_alua(dev, force_pt) < 0)
- goto out;
+ goto err_dev_list;
/*
* Startup the struct se_device processing thread
@@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!dev->tmr_wq) {
pr_err("Unable to create tmr workqueue for %s\n",
dev->transport->name);
- goto out;
+ goto err_dev_list;
}
/*
* Setup work_queue for QUEUE_FULL
@@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!inquiry_prod || !inquiry_rev) {
pr_err("All non TCM/pSCSI plugins require"
" INQUIRY consts\n");
- goto out;
+ goto err_wq;
}
strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
@@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
scsi_dump_inquiry(dev);
return dev;
-out:
- destroy_workqueue(dev->tmr_wq);
+err_wq:
+ destroy_workqueue(dev->tmr_wq);
+err_dev_list:
spin_lock(&hba->device_lock);
list_del(&dev->dev_list);
hba->dev_count--;
^ permalink raw reply related [flat|nested] 4+ messages in thread* [patch] target: NULL dereference on error path
@ 2012-07-20 7:07 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2012-07-20 7:07 UTC (permalink / raw)
To: Nicholas A. Bellinger; +Cc: linux-scsi, target-devel, kernel-janitors
We called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated
which leads to an oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7647eca..0eaae23 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
* Setup the Asymmetric Logical Unit Assignment for struct se_device
*/
if (core_setup_alua(dev, force_pt) < 0)
- goto out;
+ goto err_dev_list;
/*
* Startup the struct se_device processing thread
@@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!dev->tmr_wq) {
pr_err("Unable to create tmr workqueue for %s\n",
dev->transport->name);
- goto out;
+ goto err_dev_list;
}
/*
* Setup work_queue for QUEUE_FULL
@@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!inquiry_prod || !inquiry_rev) {
pr_err("All non TCM/pSCSI plugins require"
" INQUIRY consts\n");
- goto out;
+ goto err_wq;
}
strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
@@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
scsi_dump_inquiry(dev);
return dev;
-out:
- destroy_workqueue(dev->tmr_wq);
+err_wq:
+ destroy_workqueue(dev->tmr_wq);
+err_dev_list:
spin_lock(&hba->device_lock);
list_del(&dev->dev_list);
hba->dev_count--;
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [patch] target: NULL dereference on error path
2012-07-20 7:07 ` Dan Carpenter
@ 2012-07-20 18:38 ` Nicholas A. Bellinger
-1 siblings, 0 replies; 4+ messages in thread
From: Nicholas A. Bellinger @ 2012-07-20 18:38 UTC (permalink / raw)
To: Dan Carpenter
Cc: linux-scsi, target-devel, kernel-janitors, Christoph Hellwig
On Fri, 2012-07-20 at 10:07 +0300, Dan Carpenter wrote:
> We called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated
> which leads to an oops.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
Looks good. Applied to for-next w/ a comment pointing to:
commit af8772926f019b7bddd7477b8de5f3b0f12bad21
Author: Christoph Hellwig <hch@infradead.org>
Date: Sun Jul 8 15:58:49 2012 -0400
target: replace the processing thread with a TMR work queue
Thanks DanC!
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 7647eca..0eaae23 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
> * Setup the Asymmetric Logical Unit Assignment for struct se_device
> */
> if (core_setup_alua(dev, force_pt) < 0)
> - goto out;
> + goto err_dev_list;
>
> /*
> * Startup the struct se_device processing thread
> @@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
> if (!dev->tmr_wq) {
> pr_err("Unable to create tmr workqueue for %s\n",
> dev->transport->name);
> - goto out;
> + goto err_dev_list;
> }
> /*
> * Setup work_queue for QUEUE_FULL
> @@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
> if (!inquiry_prod || !inquiry_rev) {
> pr_err("All non TCM/pSCSI plugins require"
> " INQUIRY consts\n");
> - goto out;
> + goto err_wq;
> }
>
> strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
> @@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
> scsi_dump_inquiry(dev);
>
> return dev;
> -out:
> - destroy_workqueue(dev->tmr_wq);
>
> +err_wq:
> + destroy_workqueue(dev->tmr_wq);
> +err_dev_list:
> spin_lock(&hba->device_lock);
> list_del(&dev->dev_list);
> hba->dev_count--;
> --
> To unsubscribe from this list: send the line "unsubscribe target-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] target: NULL dereference on error path
@ 2012-07-20 18:38 ` Nicholas A. Bellinger
0 siblings, 0 replies; 4+ messages in thread
From: Nicholas A. Bellinger @ 2012-07-20 18:38 UTC (permalink / raw)
To: Dan Carpenter
Cc: linux-scsi, target-devel, kernel-janitors, Christoph Hellwig
On Fri, 2012-07-20 at 10:07 +0300, Dan Carpenter wrote:
> We called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated
> which leads to an oops.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
Looks good. Applied to for-next w/ a comment pointing to:
commit af8772926f019b7bddd7477b8de5f3b0f12bad21
Author: Christoph Hellwig <hch@infradead.org>
Date: Sun Jul 8 15:58:49 2012 -0400
target: replace the processing thread with a TMR work queue
Thanks DanC!
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 7647eca..0eaae23 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
> * Setup the Asymmetric Logical Unit Assignment for struct se_device
> */
> if (core_setup_alua(dev, force_pt) < 0)
> - goto out;
> + goto err_dev_list;
>
> /*
> * Startup the struct se_device processing thread
> @@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
> if (!dev->tmr_wq) {
> pr_err("Unable to create tmr workqueue for %s\n",
> dev->transport->name);
> - goto out;
> + goto err_dev_list;
> }
> /*
> * Setup work_queue for QUEUE_FULL
> @@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
> if (!inquiry_prod || !inquiry_rev) {
> pr_err("All non TCM/pSCSI plugins require"
> " INQUIRY consts\n");
> - goto out;
> + goto err_wq;
> }
>
> strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
> @@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
> scsi_dump_inquiry(dev);
>
> return dev;
> -out:
> - destroy_workqueue(dev->tmr_wq);
>
> +err_wq:
> + destroy_workqueue(dev->tmr_wq);
> +err_dev_list:
> spin_lock(&hba->device_lock);
> list_del(&dev->dev_list);
> hba->dev_count--;
> --
> To unsubscribe from this list: send the line "unsubscribe target-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-07-20 18:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-07-20 7:07 [patch] target: NULL dereference on error path Dan Carpenter
2012-07-20 7:07 ` Dan Carpenter
2012-07-20 18:38 ` Nicholas A. Bellinger
2012-07-20 18:38 ` Nicholas A. Bellinger
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.