[PATCH 0/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[PATCH 0/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[Douglas Miller]

See [PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[Douglas Miller]

On error, kthread_create() returns an errno-encoded pointer, not NULL.
The routine qla2x00_probe_one() detects the error case and jumps
to probe_failed, but has already assigned the return value from
kthread_create() to ha->dpc_thread.  Then probe_failed checks to see
if ha->dpc_thread is not NULL before doing cleanup on it. Since in the
error case this is also not NULL, it ends up trying to access an invalid
task pointer.

Solution is to assign NULL to ha->dpc_thread in the error path to avoid
kthread cleanup in that case.

Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
---
 drivers/scsi/qla2xxx/qla_os.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 9372098..bd39bf2 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3212,6 +3212,7 @@ static void qla2x00_iocb_work_fn(struct work_struct *work)
 		ql_log(ql_log_fatal, base_vha, 0x00ed,
 		    "Failed to start DPC thread.\n");
 		ret = PTR_ERR(ha->dpc_thread);
+		ha->dpc_thread = NULL;
 		goto probe_failed;
 	}
 	ql_dbg(ql_dbg_init, base_vha, 0x00ee,
-- 
1.7.1

Re: [PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[Martin K. Petersen]

Douglas,

> On error, kthread_create() returns an errno-encoded pointer, not NULL.
> The routine qla2x00_probe_one() detects the error case and jumps
> to probe_failed, but has already assigned the return value from
> kthread_create() to ha->dpc_thread.  Then probe_failed checks to see
> if ha->dpc_thread is not NULL before doing cleanup on it. Since in the
> error case this is also not NULL, it ends up trying to access an invalid
> task pointer.
>
> Solution is to assign NULL to ha->dpc_thread in the error path to avoid
> kthread cleanup in that case.

QLogic folks: Please review!

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[Madhani, Himanshu]

> On Oct 20, 2017, at 6:17 AM, Douglas Miller <dougmill@linux.vnet.ibm.com> wrote:
> 
> On error, kthread_create() returns an errno-encoded pointer, not NULL.
> The routine qla2x00_probe_one() detects the error case and jumps
> to probe_failed, but has already assigned the return value from
> kthread_create() to ha->dpc_thread.  Then probe_failed checks to see
> if ha->dpc_thread is not NULL before doing cleanup on it. Since in the
> error case this is also not NULL, it ends up trying to access an invalid
> task pointer.
> 
> Solution is to assign NULL to ha->dpc_thread in the error path to avoid
> kthread cleanup in that case.
> 
> Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
> ---
> drivers/scsi/qla2xxx/qla_os.c |    1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
> index 9372098..bd39bf2 100644
> --- a/drivers/scsi/qla2xxx/qla_os.c
> +++ b/drivers/scsi/qla2xxx/qla_os.c
> @@ -3212,6 +3212,7 @@ static void qla2x00_iocb_work_fn(struct work_struct *work)
> 		ql_log(ql_log_fatal, base_vha, 0x00ed,
> 		    "Failed to start DPC thread.\n");
> 		ret = PTR_ERR(ha->dpc_thread);
> +		ha->dpc_thread = NULL;
> 		goto probe_failed;
> 	}
> 	ql_dbg(ql_dbg_init, base_vha, 0x00ee,
> -- 
> 1.7.1
> 

Looks good. 

Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>

Thanks,
- Himanshu

Re: [PATCH 1/1] qla2xxx: Fix oops in qla2x00_probe_one error path

[Martin K. Petersen]

Douglas,

> On error, kthread_create() returns an errno-encoded pointer, not NULL.
> The routine qla2x00_probe_one() detects the error case and jumps
> to probe_failed, but has already assigned the return value from
> kthread_create() to ha->dpc_thread.  Then probe_failed checks to see
> if ha->dpc_thread is not NULL before doing cleanup on it. Since in the
> error case this is also not NULL, it ends up trying to access an invalid
> task pointer.
>
> Solution is to assign NULL to ha->dpc_thread in the error path to avoid
> kthread cleanup in that case.

Applied to 4.14/scsi-fixes. Thank you!

-- 
Martin K. Petersen	Oracle Linux Engineering