On Mon, 7 Nov 2022 20:48:28 +0800, Yang Yingliang wrote:
> If transport_add_device() fails in sas_phy_add(), it's not handled,
> it will lead kernel crash because of trying to delete not added device
> in transport_remove_device() called from sas_remove_host().
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108
> CPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc1+ #173
> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : device_del+0x54/0x3d0
> lr : device_del+0x37c/0x3d0
> Call trace:
> device_del+0x54/0x3d0
> attribute_container_class_device_del+0x28/0x38
> transport_remove_classdev+0x6c/0x80
> attribute_container_device_trigger+0x108/0x110
> transport_remove_device+0x28/0x38
> sas_phy_delete+0x30/0x60 [scsi_transport_sas]
> do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas]
> device_for_each_child+0x68/0xb0
> sas_remove_children+0x40/0x50 [scsi_transport_sas]
> sas_remove_host+0x20/0x38 [scsi_transport_sas]
> hisi_sas_remove+0x40/0x68 [hisi_sas_main]
> hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw]
> platform_remove+0x2c/0x60
>
> [...]
Applied to 6.1/scsi-fixes, thanks!
[1/1] scsi: scsi_transport_sas: fix error handling in sas_phy_add()
https://git.kernel.org/mkp/scsi/c/5d7bebf2dfb0
--
Martin K. Petersen Oracle Linux Engineering
