[PATCH] Drivers: hv: util: Fix transport teardown on util_probe() failure

[Andrey Misiurov]

Commit 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer
not initialized yet") moved the creation of the KVP and VSS transports
after vmbus_open(). util_probe() still calls srv->util_deinit() when
vmbus_open() or util_init_transport() fails, and hv_kvp_deinit() and
hv_vss_deinit() destroy hvt unconditionally.

On the first probe, or when hvutil_transport_init() has failed, hvt is
NULL and hvutil_transport_destroy() dereferences it.  After an unbind,
hvt still points to the transport freed by util_remove(), so a failed
re-probe frees it a second time.

Skip the destroy when there is no transport and clear hvt after it.

Found while reviewing a backport of commit 07a756a49f4b.
Not reproduced at runtime.

Fixes: 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Andrey Misiurov <amisiurov@xxxxxxxxxxxxxx>
---
 drivers/hv/hv_kvp.c      | 5 ++++-
 drivers/hv/hv_snapshot.c | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 336b278..813bec5 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -825,5 +825,8 @@ void hv_kvp_deinit(void)
 
 	hv_kvp_cancel_work();
 
-	hvutil_transport_destroy(hvt);
+	if (hvt) {
+		hvutil_transport_destroy(hvt);
+		hvt = NULL;
+	}
 }
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index 847dc69..a827cef 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -456,5 +456,8 @@ void hv_vss_deinit(void)
 
 	hv_vss_cancel_work();
 
-	hvutil_transport_destroy(hvt);
+	if (hvt) {
+		hvutil_transport_destroy(hvt);
+		hvt = NULL;
+	}
 }
-- 
2.43.7