From: Dan Carpenter Date: Fri, 20 Jul 2012 07:07:34 +0000 (+0300) Subject: target: NULL dereference on error path X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2962846d14769e526b5d266f4af998b5a027b1d7;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git target: NULL dereference on error path During a failure in transport_add_device_to_core_hba() code, we called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated which leads to an oops. This fixes a regression introduced in with: commit af8772926f019b7bddd7477b8de5f3b0f12bad21 Author: Christoph Hellwig Date: Sun Jul 8 15:58:49 2012 -0400 target: replace the processing thread with a TMR work queue Signed-off-by: Dan Carpenter Cc: Christoph Hellwig Signed-off-by: Nicholas Bellinger --- diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 7647ecafbcc7..0eaae23d12b5 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba( * Setup the Asymmetric Logical Unit Assignment for struct se_device */ if (core_setup_alua(dev, force_pt) < 0) - goto out; + goto err_dev_list; /* * Startup the struct se_device processing thread @@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba( if (!dev->tmr_wq) { pr_err("Unable to create tmr workqueue for %s\n", dev->transport->name); - goto out; + goto err_dev_list; } /* * Setup work_queue for QUEUE_FULL @@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba( if (!inquiry_prod || !inquiry_rev) { pr_err("All non TCM/pSCSI plugins require" " INQUIRY consts\n"); - goto out; + goto err_wq; } strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8); @@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba( scsi_dump_inquiry(dev); return dev; -out: - destroy_workqueue(dev->tmr_wq); +err_wq: + destroy_workqueue(dev->tmr_wq); +err_dev_list: spin_lock(&hba->device_lock); list_del(&dev->dev_list); hba->dev_count--;