Re: [PATCH 4/5] be2iscsi: check before destroy

[Mike Christie <michaelc@xxxxxxxxxxx>]

On 03/25/2011 04:24 PM, jayamohan.kallickal@xxxxxxxxxx wrote:
> From: Jayamohan Kallickal<jayamohan.kallickal@xxxxxxxxxx>
>
>       This patch checks if boot_kset is created before
> 	 attempting to destroy it.
>
> Signed-off-by: Jayamohan Kallickal<jayamohan.kallickal@xxxxxxxxxx>
> ---
>   drivers/scsi/be2iscsi/be_main.c |    6 ++++--
>   1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
> index 7fe38a4..91b354d 100644
> --- a/drivers/scsi/be2iscsi/be_main.c
> +++ b/drivers/scsi/be2iscsi/be_main.c
> @@ -420,7 +420,8 @@ static int beiscsi_setup_boot_info(struct beiscsi_hba *phba)
>   	return 0;
>
>   free_kset:
> -	iscsi_boot_destroy_kset(phba->boot_kset);
> +	if (phba->boot_kset)
> +		iscsi_boot_destroy_kset(phba->boot_kset);

This check is not needed, because in this path it is always set.

I fixed this up for you and made it so iscsi_boot_destroy_kset checks 
for null for the caller like how kfree does.

be2iscsi: Fix boot_kset destruction

This patch has iscsi_boot_destroy_kset check for NULL boot_ksets,
before destroying them. This fixes a bug in be2iscsi's rmmod
path where it was passing in a NULL boot_kset when boot was
not setup.

This also fixes a bug where be2iscsi was accessing memory that
was freed. It was calling iscsi_boot_destroy_kset and
accessing the phba after calling iscsi_host_free which could
free the phba.

Signed-off-by: Mike Christie <michaelc@xxxxxxxxxxx>

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 24e20ba..d01f2fe 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -4144,10 +4144,10 @@ static void beiscsi_remove(struct pci_dev *pcidev)
 			    phba->ctrl.mbox_mem_alloced.size,
 			    phba->ctrl.mbox_mem_alloced.va,
 			    phba->ctrl.mbox_mem_alloced.dma);
+	iscsi_boot_destroy_kset(phba->boot_kset);
 	iscsi_host_remove(phba->shost);
 	pci_dev_put(phba->pcidev);
 	iscsi_host_free(phba->shost);
-	iscsi_boot_destroy_kset(phba->boot_kset);
 }
 
 static void beiscsi_msix_enable(struct beiscsi_hba *phba)
diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
index df6bff7..0d8b0cd 100644
--- a/drivers/scsi/iscsi_boot_sysfs.c
+++ b/drivers/scsi/iscsi_boot_sysfs.c
@@ -472,6 +472,9 @@ void iscsi_boot_destroy_kset(struct iscsi_boot_kset *boot_kset)
 {
 	struct iscsi_boot_kobj *boot_kobj, *tmp_kobj;
 
+	if (!boot_kset)
+		return;
+
 	list_for_each_entry_safe(boot_kobj, tmp_kobj,
 				 &boot_kset->kobj_list, list)
 		iscsi_boot_remove_kobj(boot_kobj);