Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2962846d authored by Dan Carpenter's avatar Dan Carpenter Committed by Nicholas Bellinger
Browse files

target: NULL dereference on error path 



During a failure in transport_add_device_to_core_hba() code, we called
destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated which leads
to an oops.

This fixes a regression introduced in with:

commit af877292
Author: Christoph Hellwig <hch@infradead.org>
Date:   Sun Jul 8 15:58:49 2012 -0400

    target: replace the processing thread with a TMR work queue

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent d6dfc868

drivers/target/target_core_transport.c

+6 −5
Original line number Diff line number Diff line
@@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba( 
	 * Setup the Asymmetric Logical Unit Assignment for struct se_device

	 */

	if (core_setup_alua(dev, force_pt) < 0)

		goto out;

		goto err_dev_list;



	/*

	 * Startup the struct se_device processing thread
@@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba( 
	if (!dev->tmr_wq) {

		pr_err("Unable to create tmr workqueue for %s\n",

			dev->transport->name);

		goto out;

		goto err_dev_list;

	}

	/*

	 * Setup work_queue for QUEUE_FULL
@@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba( 
		if (!inquiry_prod || !inquiry_rev) {

			pr_err("All non TCM/pSCSI plugins require"

				" INQUIRY consts\n");

			goto out;

			goto err_wq;

		}



		strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
@@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba( 
	scsi_dump_inquiry(dev);



	return dev;

out:

	destroy_workqueue(dev->tmr_wq);



err_wq:

	destroy_workqueue(dev->tmr_wq);

err_dev_list:

	spin_lock(&hba->device_lock);

	list_del(&dev->dev_list);

	hba->dev_count--;