target: NULL dereference on error path

During a failure in transport_add_device_to_core_hba() code, we called
destroy_workqueue(dev->tmr_wq) before ->tmr_wq was allocated which leads
to an oops.

This fixes a regression introduced in with:

commit af8772926f019b7bddd7477b8de5f3b0f12bad21
Author: Christoph Hellwig <hch@infradead.org>
Date:   Sun Jul 8 15:58:49 2012 -0400

    target: replace the processing thread with a TMR work queue

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

1 files changed, 6 insertions, 5 deletions

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7647ecafbcc7..0eaae23d12b5 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1098,7 +1098,7 @@ struct se_device *transport_add_device_to_core_hba(
          * Setup the Asymmetric Logical Unit Assignment for struct se_device
          */
         if (core_setup_alua(dev, force_pt) < 0)
-                goto out;
+                goto err_dev_list;
 
         /*
          * Startup the struct se_device processing thread
@@ -1108,7 +1108,7 @@ struct se_device *transport_add_device_to_core_hba(
         if (!dev->tmr_wq) {
                 pr_err("Unable to create tmr workqueue for %s\n",
                         dev->transport->name);
-                goto out;
+                goto err_dev_list;
         }
         /*
          * Setup work_queue for QUEUE_FULL
@@ -1126,7 +1126,7 @@ struct se_device *transport_add_device_to_core_hba(
                 if (!inquiry_prod || !inquiry_rev) {
                         pr_err("All non TCM/pSCSI plugins require"
                                 " INQUIRY consts\n");
-                        goto out;
+                        goto err_wq;
                 }
 
                 strncpy(&dev->se_sub_dev->t10_wwn.vendor[0], "LIO-ORG", 8);
@@ -1136,9 +1136,10 @@ struct se_device *transport_add_device_to_core_hba(
         scsi_dump_inquiry(dev);
 
         return dev;
-out:
-        destroy_workqueue(dev->tmr_wq);
 
+err_wq:
+        destroy_workqueue(dev->tmr_wq);
+err_dev_list:
         spin_lock(&hba->device_lock);
         list_del(&dev->dev_list);
         hba->dev_count--;