• Nicholas Bellinger's avatar
    target: Fix virtual LUN=0 target_configure_device failure OOPs · b54521a3
    Nicholas Bellinger authored
    [ Upstream commit 5f7da044 ]
    
    This patch fixes a NULL pointer dereference triggered by a late
    target_configure_device() -> alloc_workqueue() failure that results
    in target_free_device() being called with DF_CONFIGURED already set,
    which subsequently OOPses in destroy_workqueue() code.
    
    Currently this only happens at modprobe target_core_mod time when
    core_dev_setup_virtual_lun0() -> target_configure_device() fails,
    and the explicit target_free_device() gets called.
    
    To address this bug originally introduced by commit 0fd97ccf, go
    ahead and move DF_CONFIGURED to end of target_configure_device()
    code to handle this special failure case.
    Reported-by: default avatarClaudio Fleiner <cmf@daterainc.com>
    Cc: Claudio Fleiner <cmf@daterainc.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: <stable@vger.kernel.org> # v3.7+
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
    b54521a3
target_core_device.c 46 KB