mirror of
https://github.com/torvalds/linux
synced 2024-10-08 20:34:15 +00:00
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
A use-after-free crash can occur after an ELS LOGO is aborted. Specifically, a nodelist structure is freed and then ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the discovery state machine is mistakenly called a second time with NLP_EVT_DEVICE_RM argument. Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a nodelist structure. Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
6f808bd78e
commit
b1b3440f43
|
@ -2998,10 +2998,7 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
|
||||||
ndlp->nlp_DID, ulp_status,
|
ndlp->nlp_DID, ulp_status,
|
||||||
ulp_word4);
|
ulp_word4);
|
||||||
|
|
||||||
/* Call NLP_EVT_DEVICE_RM if link is down or LOGO is aborted */
|
|
||||||
if (lpfc_error_lost_link(ulp_status, ulp_word4)) {
|
if (lpfc_error_lost_link(ulp_status, ulp_word4)) {
|
||||||
lpfc_disc_state_machine(vport, ndlp, cmdiocb,
|
|
||||||
NLP_EVT_DEVICE_RM);
|
|
||||||
skip_recovery = 1;
|
skip_recovery = 1;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
@ -3021,18 +3018,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
|
||||||
spin_unlock_irq(&ndlp->lock);
|
spin_unlock_irq(&ndlp->lock);
|
||||||
lpfc_disc_state_machine(vport, ndlp, cmdiocb,
|
lpfc_disc_state_machine(vport, ndlp, cmdiocb,
|
||||||
NLP_EVT_DEVICE_RM);
|
NLP_EVT_DEVICE_RM);
|
||||||
lpfc_els_free_iocb(phba, cmdiocb);
|
goto out_rsrc_free;
|
||||||
lpfc_nlp_put(ndlp);
|
|
||||||
|
|
||||||
/* Presume the node was released. */
|
|
||||||
return;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
out:
|
out:
|
||||||
/* Driver is done with the IO. */
|
|
||||||
lpfc_els_free_iocb(phba, cmdiocb);
|
|
||||||
lpfc_nlp_put(ndlp);
|
|
||||||
|
|
||||||
/* At this point, the LOGO processing is complete. NOTE: For a
|
/* At this point, the LOGO processing is complete. NOTE: For a
|
||||||
* pt2pt topology, we are assuming the NPortID will only change
|
* pt2pt topology, we are assuming the NPortID will only change
|
||||||
* on link up processing. For a LOGO / PLOGI initiated by the
|
* on link up processing. For a LOGO / PLOGI initiated by the
|
||||||
|
@ -3059,6 +3048,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
|
||||||
ndlp->nlp_DID, ulp_status,
|
ndlp->nlp_DID, ulp_status,
|
||||||
ulp_word4, tmo,
|
ulp_word4, tmo,
|
||||||
vport->num_disc_nodes);
|
vport->num_disc_nodes);
|
||||||
|
|
||||||
|
lpfc_els_free_iocb(phba, cmdiocb);
|
||||||
|
lpfc_nlp_put(ndlp);
|
||||||
|
|
||||||
lpfc_disc_start(vport);
|
lpfc_disc_start(vport);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
@ -3075,6 +3068,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
|
||||||
lpfc_disc_state_machine(vport, ndlp, cmdiocb,
|
lpfc_disc_state_machine(vport, ndlp, cmdiocb,
|
||||||
NLP_EVT_DEVICE_RM);
|
NLP_EVT_DEVICE_RM);
|
||||||
}
|
}
|
||||||
|
out_rsrc_free:
|
||||||
|
/* Driver is done with the I/O. */
|
||||||
|
lpfc_els_free_iocb(phba, cmdiocb);
|
||||||
|
lpfc_nlp_put(ndlp);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
Loading…
Reference in a new issue