diff options
| author |   Ewan D. Milne <emilne@redhat.com> | 2019-01-17 11:14:44 -0500 |
|---|---|---|
| committer |   Martin K. Petersen <martin.petersen@oracle.com> | 2019-01-22 20:40:59 -0500 |
| commit | 7961cba6f7d8215fa632df3d220e5154bb825249 (patch) | |
| tree | b8228d13b3fdbe6d6ae20cd41cbdd3627be94c61 /drivers/scsi/lpfc/lpfc_nvme.h | |
| parent | scsi: communicate max segment size to the DMA mapping code (diff) | |
| download | linux-dev-7961cba6f7d8215fa632df3d220e5154bb825249.tar.xz linux-dev-7961cba6f7d8215fa632df3d220e5154bb825249.zip | |
scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
We cannot wait on a completion object in the lpfc_nvme_lport structure in
the _destroy_localport() code path because the NVMe/fc transport will free
that structure immediately after the .localport_delete() callback. This
results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
Fix this by putting the completion on the stack.
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/scsi/lpfc/lpfc_nvme.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h index cfd4719be25c..b234d0298994 100644 --- a/drivers/scsi/lpfc/lpfc_nvme.h +++ b/drivers/scsi/lpfc/lpfc_nvme.h @@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat { /* Declare nvme-based local and remote port definitions. */ struct lpfc_nvme_lport { struct lpfc_vport *vport; - struct completion lport_unreg_done; + struct completion *lport_unreg_cmp; /* Add stats counters here */ struct lpfc_nvme_ctrl_stat *cstat; atomic_t fc4NvmeLsRequests; |