Commit 7ebf8a1
Chandrakanth Patil
scsi: mpi3mr: Fix possible crash when setting up bsg fails
JIRA: https://issues.redhat.com/browse/RHEL-30789
If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value.
Consequently, in mpi3mr_bsg_exit(), the condition "if(!mrioc->bsg_queue)"
will not be satisfied, preventing execution from entering
bsg_remove_queue(), which could lead to the following crash:
BUG: kernel NULL pointer dereference, address: 000000000000041c
Call Trace:
<TASK>
mpi3mr_bsg_exit+0x1f/0x50 [mpi3mr]
mpi3mr_remove+0x6f/0x340 [mpi3mr]
pci_device_remove+0x3f/0xb0
device_release_driver_internal+0x19d/0x220
unbind_store+0xa4/0xb0
kernfs_fop_write_iter+0x11f/0x200
vfs_write+0x1fc/0x3e0
ksys_write+0x67/0xe0
do_syscall_64+0x38/0x80
entry_SYSCALL_64_after_hwframe+0x78/0xe2
Fixes: 4268fa7 ("scsi: mpi3mr: Add bsg device support")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250107022032.24006-1-kanie@linux.alibaba.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 295006f)
Signed-off-by: Chandrakanth Patil <chanpati@redhat.com>1 parent 2314ac9 commit 7ebf8a1
1 file changed
+6
-2
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2951 | 2951 | | |
2952 | 2952 | | |
2953 | 2953 | | |
| 2954 | + | |
2954 | 2955 | | |
2955 | 2956 | | |
2956 | 2957 | | |
| |||
2966 | 2967 | | |
2967 | 2968 | | |
2968 | 2969 | | |
2969 | | - | |
| 2970 | + | |
2970 | 2971 | | |
2971 | | - | |
| 2972 | + | |
2972 | 2973 | | |
2973 | 2974 | | |
2974 | 2975 | | |
2975 | 2976 | | |
| 2977 | + | |
2976 | 2978 | | |
| 2979 | + | |
| 2980 | + | |
2977 | 2981 | | |
2978 | 2982 | | |
2979 | 2983 | | |
| |||
0 commit comments