Commit 1fe0cb84 authored by Dotan Barak's avatar Dotan Barak Committed by Roland Dreier

IB/srp: Fix remove_one crash due to resource exhaustion

If the add_one callback fails during driver load no resources are
allocated so there isn't a need to release any resources. Trying
to clean the resource may lead to the following kernel panic:

    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [<ffffffffa0132331>] srp_remove_one+0x31/0x240 [ib_srp]
    RIP: 0010:[<ffffffffa0132331>]  [<ffffffffa0132331>] srp_remove_one+0x31/0x240 [ib_srp]
    Process rmmod (pid: 4562, threadinfo ffff8800dd738000, task ffff8801167e60c0)
    Call Trace:
     [<ffffffffa024500e>] ib_unregister_client+0x4e/0x120 [ib_core]
     [<ffffffffa01361bd>] srp_cleanup_module+0x15/0x71 [ib_srp]
     [<ffffffff810ac6a4>] sys_delete_module+0x194/0x260
     [<ffffffff8100b0f2>] system_call_fastpath+0x16/0x1b
Signed-off-by: default avatarDotan Barak <dotanb@dev.mellanox.co.il>
Reviewed-by: default avatarEli Cohen <eli@mellanox.co.il>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Acked-by: default avatarSebastian Riemer <sebastian.riemer@profitbricks.com>
Acked-by: default avatarDavid Dillow <dillowda@ornl.gov>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent fedaf4ff
......@@ -2507,6 +2507,8 @@ static void srp_remove_one(struct ib_device *device)
struct srp_target_port *target;
srp_dev = ib_get_client_data(device, &srp_client);
if (!srp_dev)
return;
list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
device_unregister(&host->dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment