On 11/10/22 8:29 AM, Yang Yingliang wrote:
> In scsi_sysfs_add_host(), transport_register_device() may return
> error, if it's not handled, it will cause a null-ptr-deref while
> removing module, because transport_remove_device() is called to
> delete a device that not added.
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
> CPU: 12 PID: 14570 Comm: rmmod Kdump: loaded Not tainted 6.1.0-rc3+ #25
> pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : device_del+0x48/0x39c
> lr : device_del+0x44/0x39c
> device_del+0x48/0x39c
> attribute_container_class_device_del+0x28/0x40
> transport_remove_classdev+0x60/0x7c
> attribute_container_device_trigger+0x118/0x120
> transport_remove_device+0x20/0x30
> scsi_remove_host+0x150/0x26c
> sas_remove_host+0x54/0x70 [scsi_transport_sas]
> hisi_sas_v3_remove+0x5c/0xbc [hisi_sas_v3_hw]
>
> Fix this by checking and handling return value of transport_register_device().
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
> ---
> drivers/scsi/scsi_sysfs.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
> index cac7c902cf70..41de795f1ab2 100644
> --- a/drivers/scsi/scsi_sysfs.c
> +++ b/drivers/scsi/scsi_sysfs.c
> @@ -1607,7 +1607,11 @@ EXPORT_SYMBOL(scsi_register_interface);
> **/
> int scsi_sysfs_add_host(struct Scsi_Host *shost)
> {
> - transport_register_device(&shost->shost_gendev);
> + int ret;
> +
> + ret = transport_register_device(&shost->shost_gendev);
> + if (ret)
> + return ret;
> transport_configure_device(&shost->shost_gendev);
> return 0;
> }
Do we need to do something similar every time transport_add_device
fails? For example, in ata_tport_add if transport_add_device
and we later do transport_destroy_device in ata_tlink_delete?
The SAS and FC classes do something similar and in SCSI-ml we
have other cases for device and target additions.
