From patchwork Tue Dec 12 08:57:51 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hannes Reinecke X-Patchwork-Id: 10106515 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id F19146032B for ; Tue, 12 Dec 2017 08:58:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E491829B2F for ; Tue, 12 Dec 2017 08:58:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D9A4F29B39; Tue, 12 Dec 2017 08:58:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 89EE329B2F for ; Tue, 12 Dec 2017 08:58:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752295AbdLLI6D (ORCPT ); Tue, 12 Dec 2017 03:58:03 -0500 Received: from mx2.suse.de ([195.135.220.15]:46995 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752262AbdLLI55 (ORCPT ); Tue, 12 Dec 2017 03:57:57 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id B66CEADE0; Tue, 12 Dec 2017 08:57:55 +0000 (UTC) From: Hannes Reinecke To: "Martin K. Petersen" Cc: Christoph Hellwig , James Bottomley , Bart van Assche , linux-scsi@vger.kernel.org, Hannes Reinecke , Hannes Reinecke Subject: [PATCH 3/4] scsi: add missing get_device() return value checks Date: Tue, 12 Dec 2017 09:57:51 +0100 Message-Id: <1513069072-32514-4-git-send-email-hare@suse.de> X-Mailer: git-send-email 1.8.5.6 In-Reply-To: <1513069072-32514-1-git-send-email-hare@suse.de> References: <1513069072-32514-1-git-send-email-hare@suse.de> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We need to validate that get_device() succeeded, otherwise we'll end up working with invalid devices. Signed-off-by: Hannes Reinecke --- drivers/scsi/scsi_scan.c | 14 ++++++++++++-- drivers/scsi/sd.c | 8 +++++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c index be5e919..18edfd7 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c @@ -245,6 +245,10 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, INIT_WORK(&sdev->requeue_work, scsi_requeue_run_queue); sdev->sdev_gendev.parent = get_device(&starget->dev); + if (!sdev->sdev_gendev.parent) { + kfree(sdev); + return NULL; + } sdev->sdev_target = starget; /* usually NULL and set by ->slave_alloc instead */ @@ -366,7 +370,8 @@ static struct scsi_target *__scsi_find_target(struct device *parent, } } if (found_starget) - get_device(&found_starget->dev); + if (!get_device(&found_starget->dev)) + found_starget = NULL; return found_starget; } @@ -436,6 +441,10 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, device_initialize(dev); kref_init(&starget->reap_ref); dev->parent = get_device(parent); + if (!dev->parent) { + kfree(starget); + return NULL; + } dev_set_name(dev, "target%d:%d:%d", shost->host_no, channel, id); dev->bus = &scsi_bus_type; dev->type = &scsi_target_type; @@ -469,7 +478,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, return NULL; } } - get_device(dev); + /* No good way to recover here; keep fingers crossed */ + WARN_ON(!get_device(dev)); return starget; diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 228b0b62..abbab17 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -619,10 +619,12 @@ static struct scsi_disk *scsi_disk_get(struct gendisk *disk) if (disk->private_data) { sdkp = scsi_disk(disk); - if (scsi_device_get(sdkp->device) == 0) - get_device(&sdkp->dev); - else + if (scsi_device_get(sdkp->device)) + sdkp = NULL; + else if (!get_device(&sdkp->dev)) { + scsi_device_put(sdkp->device); sdkp = NULL; + } } mutex_unlock(&sd_ref_mutex); return sdkp;