All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tong Zhang <ztong0001@gmail.com>, Hannes Reinecke <hare@suse.de>,
	"Martin K . Petersen" <martin.petersen@oracle.com>,
	Sasha Levin <sashal@kernel.org>,
	hare@kernel.org, jejb@linux.ibm.com, linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 19/25] scsi: myrs: Fix crash in error case
Date: Thu,  3 Feb 2022 15:34:40 -0500	[thread overview]
Message-ID: <20220203203447.3570-19-sashal@kernel.org> (raw)
In-Reply-To: <20220203203447.3570-1-sashal@kernel.org>

From: Tong Zhang <ztong0001@gmail.com>

[ Upstream commit 4db09593af0b0b4d7d4805ebb3273df51d7cc30d ]

In myrs_detect(), cs->disable_intr is NULL when privdata->hw_init() fails
with non-zero. In this case, myrs_cleanup(cs) will call a NULL ptr and
crash the kernel.

[    1.105606] myrs 0000:00:03.0: Unknown Initialization Error 5A
[    1.105872] myrs 0000:00:03.0: Failed to initialize Controller
[    1.106082] BUG: kernel NULL pointer dereference, address: 0000000000000000
[    1.110774] Call Trace:
[    1.110950]  myrs_cleanup+0xe4/0x150 [myrs]
[    1.111135]  myrs_probe.cold+0x91/0x56a [myrs]
[    1.111302]  ? DAC960_GEM_intr_handler+0x1f0/0x1f0 [myrs]
[    1.111500]  local_pci_probe+0x48/0x90

Link: https://lore.kernel.org/r/20220123225717.1069538-1-ztong0001@gmail.com
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/myrs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
index 78c41bbf67562..e6a6678967e52 100644
--- a/drivers/scsi/myrs.c
+++ b/drivers/scsi/myrs.c
@@ -2272,7 +2272,8 @@ static void myrs_cleanup(struct myrs_hba *cs)
 	myrs_unmap(cs);
 
 	if (cs->mmio_base) {
-		cs->disable_intr(cs);
+		if (cs->disable_intr)
+			cs->disable_intr(cs);
 		iounmap(cs->mmio_base);
 		cs->mmio_base = NULL;
 	}
-- 
2.34.1


  parent reply	other threads:[~2022-02-03 20:40 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-03 20:34 [PATCH AUTOSEL 5.10 01/25] NFS: change nfs_access_get_cached to only report the mask Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 02/25] NFSv4 only print the label when its queried Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 03/25] nfs: nfs4clinet: check the return value of kstrdup() Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 04/25] NFSv4.1: Fix uninitialised variable in devicenotify Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 05/25] netfilter: nf_conntrack_netbios_ns: fix helper module alias Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 06/25] NFSv4 remove zero number of fs_locations entries error check Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 07/25] NFSv4 expose nfs_parse_server_name function Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 08/25] NFSv4 handle port presence in fs_location server string Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 09/25] x86/perf: Avoid warning for Arch LBR without XSAVE Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 10/25] drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer Sasha Levin
2022-02-03 20:34   ` Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 11/25] net: sched: Clarify error message when qdisc kind is unknown Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 12/25] powerpc/fixmap: Fix VM debug warning on unmap Sasha Levin
2022-02-03 20:34   ` Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 13/25] scsi: target: iscsi: Make sure the np under each tpg is unique Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 14/25] scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup() Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 15/25] scsi: qedf: Add stag_work to all the vports Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 16/25] scsi: qedf: Fix refcount issue when LOGO is received during TMF Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 17/25] scsi: pm8001: Fix bogus FW crash for maxcpus=1 Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 18/25] scsi: ufs: Treat link loss as fatal error Sasha Levin
2022-02-03 20:34 ` Sasha Levin [this message]
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 20/25] PM: wakeup: simplify the output logic of pm_show_wakelocks() Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 21/25] PM: hibernate: Remove register_nosave_region_late() Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 22/25] usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 23/25] perf: Always wake the parent event Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 24/25] nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs Sasha Levin
2022-02-03 20:34 ` [PATCH AUTOSEL 5.10 25/25] net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() Sasha Levin
2022-02-03 20:34   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220203203447.3570-19-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=hare@kernel.org \
    --cc=hare@suse.de \
    --cc=jejb@linux.ibm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=stable@vger.kernel.org \
    --cc=ztong0001@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.