In _mpt3sas_init(), when attaching mpt2sas raid functions template and
fails, mpt3sas template is not released.
raid_class_attach() calls attribute_container_register() and add list
node to attribute_container_list. If it is not unregistered and removed,
when iterating the list in other modules, already released memory
&mpt3sas_raid_functions will be accessed and cause kernel panic:
BUG: unable to handle page fault for address: fffffbfff80dd520
CPU: 0 PID: 390 Comm: modprobe
Hardware name: QEMU Standard PC
RIP: 0010:raid_match+0x65/0x150 [raid_class]
...
Call Trace:
<TASK>
attribute_container_add_device+0x124/0x320
scsi_sysfs_device_initialize+0x421/0x9b0
scsi_alloc_sdev+0x98b/0xcc0
scsi_probe_and_add_lun+0x18bf/0x29b0
...
Fix it by calling raid_class_release() to release mpt3sas template in
mpt2sas register error path.
Fixes: c84b06a48c4d ("mpt3sas: Single driver module which supports both SAS 2.0 & SAS 3.0 HBAs")
Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
---
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 8e24ebcebfe5..e20929bc3766 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -12900,6 +12900,8 @@ _mpt3sas_init(void)
mpt2sas_raid_template =
raid_class_attach(&mpt2sas_raid_functions);
if (!mpt2sas_raid_template) {
+ if (hbas_to_enumerate != 1)
+ raid_class_release(mpt3sas_raid_template);
sas_release_transport(mpt3sas_transport_template);
return -ENODEV;
}
--
2.17.1
