]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
scsi: lpfc: Fix use-after-free mailbox cmd completion
authorJames Smart <jsmart2021@gmail.com>
Tue, 12 Mar 2019 23:30:06 +0000 (16:30 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 31 May 2019 13:43:55 +0000 (06:43 -0700)
commitdc974c86b8b3ac9560f1e5dfba79ff5ecbcdc3ea
treec5213ea1efc52e3e77ee6ba706a0e4b7e5e84d05
parent0c80098e7da110ce66f0e8d1ae4d2f3134b32586
scsi: lpfc: Fix use-after-free mailbox cmd completion

[ Upstream commit 9b1640686470fbbd1c6efb35ada6fe1427ea8d0f ]

When unloading the driver, mailbox commands may be sent without holding a
reference on the ndlp. By the time the mailbox command completes, the ndlp
may have reduced its ref counts and been freed.  The problem was reported
by KASAN.

While unregistering due to driver unload, have the completion noop'd by
setting the ndlp context NULL'd. Due to the unload, no further action was
necessary.  Also, while reviewing this path, the generic nulling of the
context after handling should be slightly moved.

Reported by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/scsi/lpfc/lpfc_hbadisc.c
drivers/scsi/lpfc/lpfc_sli.c