| Message ID | 20221103092404.192621-1-chenzhongjin@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | mpt3sas: Fix leaked raid template in _mpt3sas_init() | expand |
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c index 8e24ebcebfe5..e20929bc3766 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -12900,6 +12900,8 @@ _mpt3sas_init(void) mpt2sas_raid_template = raid_class_attach(&mpt2sas_raid_functions); if (!mpt2sas_raid_template) { + if (hbas_to_enumerate != 1) + raid_class_release(mpt3sas_raid_template); sas_release_transport(mpt3sas_transport_template); return -ENODEV; }
In _mpt3sas_init(), when attaching mpt2sas raid functions template and fails, mpt3sas template is not released. raid_class_attach() calls attribute_container_register() and add list node to attribute_container_list. If it is not unregistered and removed, when iterating the list in other modules, already released memory &mpt3sas_raid_functions will be accessed and cause kernel panic: BUG: unable to handle page fault for address: fffffbfff80dd520 CPU: 0 PID: 390 Comm: modprobe Hardware name: QEMU Standard PC RIP: 0010:raid_match+0x65/0x150 [raid_class] ... Call Trace: <TASK> attribute_container_add_device+0x124/0x320 scsi_sysfs_device_initialize+0x421/0x9b0 scsi_alloc_sdev+0x98b/0xcc0 scsi_probe_and_add_lun+0x18bf/0x29b0 ... Fix it by calling raid_class_release() to release mpt3sas template in mpt2sas register error path. Fixes: c84b06a48c4d ("mpt3sas: Single driver module which supports both SAS 2.0 & SAS 3.0 HBAs") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 ++ 1 file changed, 2 insertions(+)