summaryrefslogtreecommitdiffstats
path: root/drivers/target
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2012-07-20 10:07:34 +0300
committerNicholas Bellinger <nab@linux-iscsi.org>2012-07-20 11:34:21 -0700
commit2962846d14769e526b5d266f4af998b5a027b1d7 (patch)
tree6ccd195cd39b6cbec2ed8f25e38f28ff98fdecf3 /drivers/target
parentd6dfc868bcf329392abd1ecfa7357eb51ebf8c30 (diff)
downloadlinux-2962846d14769e526b5d266f4af998b5a027b1d7.tar.gz
linux-2962846d14769e526b5d266f4af998b5a027b1d7.tar.bz2
linux-2962846d14769e526b5d266f4af998b5a027b1d7.zip
target: NULL dereference on error path
During a failure in transport_add_device_to_core_hba() code, we called destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated which leads to an oops. This fixes a regression introduced in with: commit af8772926f019b7bddd7477b8de5f3b0f12bad21 Author: Christoph Hellwig <hch@infradead.org> Date: Sun Jul 8 15:58:49 2012 -0400 target: replace the processing thread with a TMR work queue Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/target_core_transport.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7647ecafbcc7..0eaae23d12b5 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
* Setup the Asymmetric Logical Unit Assignment for struct se_device
*/
if (core_setup_alua(dev, force_pt) < 0)
- goto out;
+ goto err_dev_list;
/*
* Startup the struct se_device processing thread
@@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!dev->tmr_wq) {
pr_err("Unable to create tmr workqueue for %s\n",
dev->transport->name);
- goto out;
+ goto err_dev_list;
}
/*
* Setup work_queue for QUEUE_FULL
@@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
if (!inquiry_prod || !inquiry_rev) {
pr_err("All non TCM/pSCSI plugins require"
" INQUIRY consts\n");
- goto out;
+ goto err_wq;
}
strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
@@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
scsi_dump_inquiry(dev);
return dev;
-out:
- destroy_workqueue(dev->tmr_wq);
+err_wq:
+ destroy_workqueue(dev->tmr_wq);
+err_dev_list:
spin_lock(&hba->device_lock);
list_del(&dev->dev_list);
hba->dev_count--;