From: Douglas Miller <dougmill@linux.vnet.ibm.com>
To: linux-scsi@vger.kernel.org
Cc: qla2xxx-upstream@qlogic.com
Subject: [PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path
Date: Fri, 20 Oct 2017 08:17:22 -0500 [thread overview]
Message-ID: <1508505442-30352-2-git-send-email-dougmill@linux.vnet.ibm.com> (raw)
In-Reply-To: <1508505442-30352-1-git-send-email-dougmill@linux.vnet.ibm.com>
On error, kthread_create() returns an errno-encoded pointer, not NULL.
The routine qla2x00_probe_one() detects the error case and jumps
to probe_failed, but has already assigned the return value from
kthread_create() to ha->dpc_thread. Then probe_failed checks to see
if ha->dpc_thread is not NULL before doing cleanup on it. Since in the
error case this is also not NULL, it ends up trying to access an invalid
task pointer.
Solution is to assign NULL to ha->dpc_thread in the error path to avoid
kthread cleanup in that case.
Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
---
drivers/scsi/qla2xxx/qla_os.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 9372098..bd39bf2 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3212,6 +3212,7 @@ static void qla2x00_iocb_work_fn(struct work_struct *work)
ql_log(ql_log_fatal, base_vha, 0x00ed,
"Failed to start DPC thread.\n");
ret = PTR_ERR(ha->dpc_thread);
+ ha->dpc_thread = NULL;
goto probe_failed;
}
ql_dbg(ql_dbg_init, base_vha, 0x00ee,
--
1.7.1
next prev parent reply other threads:[~2017-10-20 13:17 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-20 13:17 [PATCH 0/1] qla2xxx: Fix oops in qla2x00_probe_one error path Douglas Miller
2017-10-20 13:17 ` Douglas Miller [this message]
2017-10-23 8:22 ` [PATCH 1/1] " Martin K. Petersen
2017-10-25 15:58 ` Madhani, Himanshu
2017-10-31 12:07 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1508505442-30352-2-git-send-email-dougmill@linux.vnet.ibm.com \
--to=dougmill@linux.vnet.ibm.com \
--cc=linux-scsi@vger.kernel.org \
--cc=qla2xxx-upstream@qlogic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.