diff options
| author | David S. Miller <davem@davemloft.net> | 2009-07-17 10:28:19 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-07-17 10:28:19 -0700 |
| commit | 14d87e6c399f3942d63dff41447ff08a615d9a6b (patch) | |
| tree | cb2c1c18a791c79f51cb9ea7516287f9b2394f97 /drivers/sbus/char | |
| parent | 8944146daa2c38dd85bc489d1b84fb9abc108837 (diff) | |
sparc: Fix cleanup crash in bbc_envctrl_cleanup()
If kthread_run() fails or never gets to run we'll have NULL
or a pointer encoded error in kenvctrld_task, rather than
a legitimate task pointer.
So this makes bbc_envctrl_cleanup() crash as it passed this
bogus pointer into kthread_stop().
Reported-by: BERTRAND Joël <joel.bertrand@systella.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/sbus/char')
| -rw-r--r-- | drivers/sbus/char/bbc_envctrl.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c index 15dab96d05e3..7c815d3327f7 100644 --- a/drivers/sbus/char/bbc_envctrl.c +++ b/drivers/sbus/char/bbc_envctrl.c @@ -537,8 +537,12 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp) } if (temp_index != 0 && fan_index != 0) { kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld"); - if (IS_ERR(kenvctrld_task)) - return PTR_ERR(kenvctrld_task); + if (IS_ERR(kenvctrld_task)) { + int err = PTR_ERR(kenvctrld_task); + + kenvctrld_task = NULL; + return err; + } } return 0; @@ -561,7 +565,8 @@ void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp) struct bbc_cpu_temperature *tp, *tpos; struct bbc_fan_control *fp, *fpos; - kthread_stop(kenvctrld_task); + if (kenvctrld_task) + kthread_stop(kenvctrld_task); list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) { list_del(&tp->bp_list); |