@@ -1620,9 +1620,22 @@ static __init int spi_transport_init(void)
error = transport_class_register(&spi_transport_class);
if (error)
- return error;
+ goto err_list;
error = anon_transport_class_register(&spi_device_class);
- return transport_class_register(&spi_host_class);
+ if (error)
+ goto err_transport;
+ error = transport_class_register(&spi_host_class);
+ if (error)
+ goto err_device;
+ return 0;
+
+err_device:
+ anon_transport_class_unregister(&spi_device_class);
+err_transport:
+ transport_class_unregister(&spi_transport_class);
+err_list:
+ scsi_dev_info_remove_list(SCSI_DEVINFO_SPI);
+ return error;
}
static void __exit spi_transport_exit(void)
In spi_transport_init(), error return values are not handled, which can makes memory leak and list node leak. anon_transport_class_register() calls attribute_container_register() and add list node to attribute_container_list. If it is not unregistered and removed, when iterating the list in other modules, already released memory &spi_device_class will be accessed and cause kernel panic: KASAN: maybe wild-memory-access in range [0x8febffffffeac550-0x8febffffffeac557] CPU: 0 PID: 381 Comm: modprobe Hardware name: QEMU Standard PC RIP: 0010:attribute_container_add_device+0xe2/0x320 ... Call Trace: <TASK> scsi_sysfs_add_host+0x1d/0x40 scsi_add_host_with_dma.cold+0x73d/0x79c sdebug_driver_probe+0x50f/0x6f0 [scsi_debug] ... Add error handling in spi_transport_init() to avoid kernel panic when module fails to load. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- drivers/scsi/scsi_transport_spi.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)