Re: [PATCH v2] scsi: mpi3mr: fix possible crash when setup bsg fail

[Guixin Liu <kanie@linux.alibaba.com>]

Gentle ping...

Best Regards,

Guixin Liu

在 2024/12/17 19:04, Guixin Liu 写道:
> If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value.
> Consequently, in mpi3mr_bsg_exit(), the condition
> "if(!mrioc->bsg_queue)" will not be satisfied, preventing execution
> from entering bsg_remove_queue(), which could lead to a crash.
>
> Fixes: 4268fa751365 ("scsi: mpi3mr: Add bsg device support")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> ---
> Changes from v1 to v2:
> - Add return statement when setup bsg queue fail, sorry for the v1
> trouble.
>   drivers/scsi/mpi3mr/mpi3mr_app.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
> index 10b8e4dc64f8..7589f48aebc8 100644
> --- a/drivers/scsi/mpi3mr/mpi3mr_app.c
> +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
> @@ -2951,6 +2951,7 @@ void mpi3mr_bsg_init(struct mpi3mr_ioc *mrioc)
>   		.max_hw_sectors		= MPI3MR_MAX_APP_XFER_SECTORS,
>   		.max_segments		= MPI3MR_MAX_APP_XFER_SEGMENTS,
>   	};
> +	struct request_queue *q;
>   
>   	device_initialize(bsg_dev);
>   
> @@ -2966,14 +2967,17 @@ void mpi3mr_bsg_init(struct mpi3mr_ioc *mrioc)
>   		return;
>   	}
>   
> -	mrioc->bsg_queue = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), &lim,
> +	q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), &lim,
>   			mpi3mr_bsg_request, NULL, 0);
> -	if (IS_ERR(mrioc->bsg_queue)) {
> +	if (IS_ERR(q)) {
>   		ioc_err(mrioc, "%s: bsg registration failed\n",
>   		    dev_name(bsg_dev));
>   		device_del(bsg_dev);
>   		put_device(bsg_dev);
> +		return;
>   	}
> +
> +	mrioc->bsg_queue = q;
>   }
>   
>   /**