Skip to content

Commit 12e750b

Browse files
YueHaibingmartinkpetersen
authored andcommitted
scsi: scsi_dh_alua: Fix possible null-ptr-deref
If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise it will trigger null-ptr-deref while unloading module which calls destroy_workqueue dereference wq->lock like this: BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0 Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045 CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ thesofproject#28 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 Call Trace: dump_stack+0xa9/0x10e __kasan_report+0x171/0x18d ? __lock_acquire+0x6b4/0x1ee0 kasan_report+0xe/0x20 __lock_acquire+0x6b4/0x1ee0 lock_acquire+0xb4/0x1b0 __mutex_lock+0xd8/0xb90 drain_workqueue+0x25/0x290 destroy_workqueue+0x1f/0x3f0 __x64_sys_delete_module+0x244/0x330 do_syscall_64+0x72/0x2a0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reported-by: Hulk Robot <[email protected]> Fixes: 03197b6 ("scsi_dh_alua: Use workqueue for RTPG") Signed-off-by: YueHaibing <[email protected]> Reviewed-by: Bart Van Assche <[email protected]> Signed-off-by: Martin K. Petersen <[email protected]>
1 parent 1d94f06 commit 12e750b

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

drivers/scsi/device_handler/scsi_dh_alua.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1174,10 +1174,8 @@ static int __init alua_init(void)
11741174
int r;
11751175

11761176
kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0);
1177-
if (!kaluad_wq) {
1178-
/* Temporary failure, bypass */
1179-
return SCSI_DH_DEV_TEMP_BUSY;
1180-
}
1177+
if (!kaluad_wq)
1178+
return -ENOMEM;
11811179

11821180
r = scsi_register_device_handler(&alua_dh);
11831181
if (r != 0) {

0 commit comments

Comments
 (0)