sparc: Fix cleanup crash in bbc_envctrl_cleanup()

If kthread_run() fails or never gets to run we'll have NULL
or a pointer encoded error in kenvctrld_task, rather than
a legitimate task pointer.

So this makes bbc_envctrl_cleanup() crash as it passed this
bogus pointer into kthread_stop().

Reported-by: BERTRAND Joël <joel.bertrand@systella.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index 15dab96d05e31328108b89dabc53ee4b2b5aa573..7c815d3327f754e095212dfc608a64f514547429 100644 (file)
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -537,8 +537,12 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
        }
        if (temp_index != 0 && fan_index != 0) {
                kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
-               if (IS_ERR(kenvctrld_task))
-                       return PTR_ERR(kenvctrld_task);
+               if (IS_ERR(kenvctrld_task)) {
+                       int err = PTR_ERR(kenvctrld_task);
+
+                       kenvctrld_task = NULL;
+                       return err;
+               }
        }
 
        return 0;
@@ -561,7 +565,8 @@ void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp)
        struct bbc_cpu_temperature *tp, *tpos;
        struct bbc_fan_control *fp, *fpos;
 
-       kthread_stop(kenvctrld_task);
+       if (kenvctrld_task)
+               kthread_stop(kenvctrld_task);
 
        list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {
                list_del(&tp->bp_list);