aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYueHaibing <yuehaibing@huawei.com>2019-05-27 22:22:09 +0800
committerPaul Gortmaker <paul.gortmaker@windriver.com>2019-09-16 12:21:44 -0400
commit87ab1372534fd0eecfa19ef2fa5a2f4d1ffb3334 (patch)
tree1c393dac50da53a7f18a9c97ec6715189368d33f
parent7eca591cf84e44e40a8e626e307a36e1dbd79765 (diff)
downloadlinux-yocto-87ab1372534fd0eecfa19ef2fa5a2f4d1ffb3334.tar.gz
linux-yocto-87ab1372534fd0eecfa19ef2fa5a2f4d1ffb3334.tar.bz2
linux-yocto-87ab1372534fd0eecfa19ef2fa5a2f4d1ffb3334.zip
scsi: scsi_dh_alua: Fix possible null-ptr-deref
commit 12e750bc62044de096ab9a95201213fd912b9994 upstream. If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise it will trigger null-ptr-deref while unloading module which calls destroy_workqueue dereference wq->lock like this: BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0 Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045 CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 Call Trace: dump_stack+0xa9/0x10e __kasan_report+0x171/0x18d ? __lock_acquire+0x6b4/0x1ee0 kasan_report+0xe/0x20 __lock_acquire+0x6b4/0x1ee0 lock_acquire+0xb4/0x1b0 __mutex_lock+0xd8/0xb90 drain_workqueue+0x25/0x290 destroy_workqueue+0x1f/0x3f0 __x64_sys_delete_module+0x244/0x330 do_syscall_64+0x72/0x2a0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reported-by: Hulk Robot <hulkci@huawei.com> Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--drivers/scsi/device_handler/scsi_dh_alua.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 12dc7100bb4c..d1154baa9436 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -1173,10 +1173,8 @@ static int __init alua_init(void)
int r;
kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0);
- if (!kaluad_wq) {
- /* Temporary failure, bypass */
- return SCSI_DH_DEV_TEMP_BUSY;
- }
+ if (!kaluad_wq)
+ return -ENOMEM;
r = scsi_register_device_handler(&alua_dh);
if (r != 0) {