From owner-svn-src-head@freebsd.org Tue Mar 7 23:06:43 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0F96BD02405; Tue, 7 Mar 2017 23:06:43 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D313718FD; Tue, 7 Mar 2017 23:06:42 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v27N6fMe007049; Tue, 7 Mar 2017 23:06:41 GMT (envelope-from imp@FreeBSD.org) Received: (from imp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v27N6f5S007047; Tue, 7 Mar 2017 23:06:41 GMT (envelope-from imp@FreeBSD.org) Message-Id: <201703072306.v27N6f5S007047@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: imp set sender to imp@FreeBSD.org using -f From: Warner Losh Date: Tue, 7 Mar 2017 23:06:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r314889 - head/sys/dev/nvme X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 23:06:43 -0000 Author: imp Date: Tue Mar 7 23:06:41 2017 New Revision: 314889 URL: https://svnweb.freebsd.org/changeset/base/314889 Log: Avoid dereferencing unintialized elements in the error path. Some drives sometimes have errors for things like setting the number of queue entries in the submission queue. The error paths taken for these drives ensure a panic dereferencing uninialized data. Sponsored by: Netflix Modified: head/sys/dev/nvme/nvme_ctrlr.c head/sys/dev/nvme/nvme_qpair.c Modified: head/sys/dev/nvme/nvme_ctrlr.c ============================================================================== --- head/sys/dev/nvme/nvme_ctrlr.c Tue Mar 7 23:02:59 2017 (r314888) +++ head/sys/dev/nvme/nvme_ctrlr.c Tue Mar 7 23:06:41 2017 (r314889) @@ -193,8 +193,10 @@ nvme_ctrlr_fail(struct nvme_controller * ctrlr->is_failed = TRUE; nvme_qpair_fail(&ctrlr->adminq); - for (i = 0; i < ctrlr->num_io_queues; i++) - nvme_qpair_fail(&ctrlr->ioq[i]); + if (ctrlr->ioq != NULL) { + for (i = 0; i < ctrlr->num_io_queues; i++) + nvme_qpair_fail(&ctrlr->ioq[i]); + } nvme_notify_fail_consumers(ctrlr); } @@ -397,7 +399,7 @@ nvme_ctrlr_set_num_qpairs(struct nvme_co while (status.done == FALSE) pause("nvme", 1); if (nvme_completion_is_error(&status.cpl)) { - nvme_printf(ctrlr, "nvme_set_num_queues failed!\n"); + nvme_printf(ctrlr, "nvme_ctrlr_set_num_qpairs failed!\n"); return (ENXIO); } Modified: head/sys/dev/nvme/nvme_qpair.c ============================================================================== --- head/sys/dev/nvme/nvme_qpair.c Tue Mar 7 23:02:59 2017 (r314888) +++ head/sys/dev/nvme/nvme_qpair.c Tue Mar 7 23:06:41 2017 (r314889) @@ -1000,6 +1000,9 @@ nvme_qpair_fail(struct nvme_qpair *qpair struct nvme_tracker *tr; struct nvme_request *req; + if (!mtx_initialized(&qpair->lock)) + return; + mtx_lock(&qpair->lock); while (!STAILQ_EMPTY(&qpair->queued_req)) {