Commit e2532b4a authored by Douglas Miller's avatar Douglas Miller Committed by Martin K. Petersen

scsi: qla2xxx: Fix oops in qla2x00_probe_one error path

On error, kthread_create() returns an errno-encoded pointer, not NULL.
The routine qla2x00_probe_one() detects the error case and jumps to
probe_failed, but has already assigned the return value from
kthread_create() to ha->dpc_thread.  Then probe_failed checks to see if
ha->dpc_thread is not NULL before doing cleanup on it. Since in the
error case this is also not NULL, it ends up trying to access an invalid
task pointer.

Solution is to assign NULL to ha->dpc_thread in the error path to avoid
kthread cleanup in that case.
Signed-off-by: default avatarDouglas Miller <dougmill@linux.vnet.ibm.com>
Acked-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 8fe8ffb1
...@@ -3212,6 +3212,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) ...@@ -3212,6 +3212,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
ql_log(ql_log_fatal, base_vha, 0x00ed, ql_log(ql_log_fatal, base_vha, 0x00ed,
"Failed to start DPC thread.\n"); "Failed to start DPC thread.\n");
ret = PTR_ERR(ha->dpc_thread); ret = PTR_ERR(ha->dpc_thread);
ha->dpc_thread = NULL;
goto probe_failed; goto probe_failed;
} }
ql_dbg(ql_dbg_init, base_vha, 0x00ee, ql_dbg(ql_dbg_init, base_vha, 0x00ee,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment