sparc: Fix cleanup crash in bbc_envctrl_cleanup() (14d87e6c) · Commits · 戴 / test

If kthread_run() fails or never gets to run we'll have NULL or a pointer encoded error in kenvctrld_task, rather than a legitimate task pointer. So this makes bbc_envctrl_cleanup() crash as it passed this bogus pointer into kthread_stop(). Reported-by:

BERTRAND Joël <joel.bertrand@systella.fr> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/sbus/char/bbc_envctrl.c

+8 −3

Original line number	Diff line number	Diff line
		@@ -537,8 +537,12 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
		}
		if (temp_index != 0 && fan_index != 0) {
		kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
		if (IS_ERR(kenvctrld_task))
		return PTR_ERR(kenvctrld_task);
		if (IS_ERR(kenvctrld_task)) {
		int err = PTR_ERR(kenvctrld_task);

		kenvctrld_task = NULL;
		return err;
		}
		}

		return 0;
		@@ -561,6 +565,7 @@ void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp)
		struct bbc_cpu_temperature tp, tpos;
		struct bbc_fan_control fp, fpos;

		if (kenvctrld_task)
		kthread_stop(kenvctrld_task);

		list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {

Admin message