• Nicholas Bellinger's avatar
    target: Fix virtual LUN=0 target_configure_device failure OOPs · 826376b4
    Nicholas Bellinger authored
    commit 5f7da044 upstream.
    
    This patch fixes a NULL pointer dereference triggered by a late
    target_configure_device() -> alloc_workqueue() failure that results
    in target_free_device() being called with DF_CONFIGURED already set,
    which subsequently OOPses in destroy_workqueue() code.
    
    Currently this only happens at modprobe target_core_mod time when
    core_dev_setup_virtual_lun0() -> target_configure_device() fails,
    and the explicit target_free_device() gets called.
    
    To address this bug originally introduced by commit 0fd97ccf, go
    ahead and move DF_CONFIGURED to end of target_configure_device()
    code to handle this special failure case.
    Reported-by: default avatarClaudio Fleiner <cmf@daterainc.com>
    Cc: Claudio Fleiner <cmf@daterainc.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
    826376b4
target_core_device.c 43.3 KB