diff options
| author |   James Smart <jsmart2021@gmail.com> | 2019-03-12 16:30:06 -0700 |
|---|---|---|
| committer |   Martin K. Petersen <martin.petersen@oracle.com> | 2019-03-19 12:57:01 -0400 |
| commit | 9b1640686470fbbd1c6efb35ada6fe1427ea8d0f (patch) | |
| tree | 8584d1a75f75b873d9b546bd6ed3a55cf47eeb36 /drivers/scsi/lpfc/lpfc_sli.c | |
| parent | scsi: lpfc: Resolve irq-unsafe lockdep heirarchy warning in lpfc_io_free (diff) | |
| download | linux-dev-9b1640686470fbbd1c6efb35ada6fe1427ea8d0f.tar.xz linux-dev-9b1640686470fbbd1c6efb35ada6fe1427ea8d0f.zip | |
scsi: lpfc: Fix use-after-free mailbox cmd completion
When unloading the driver, mailbox commands may be sent without holding a
reference on the ndlp. By the time the mailbox command completes, the ndlp
may have reduced its ref counts and been freed. The problem was reported
by KASAN.
While unregistering due to driver unload, have the completion noop'd by
setting the ndlp context NULL'd. Due to the unload, no further action was
necessary. Also, while reviewing this path, the generic nulling of the
context after handling should be slightly moved.
Reported by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/lpfc/lpfc_sli.c')
| -rw-r--r-- | drivers/scsi/lpfc/lpfc_sli.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 57b4a463b589..de5715b07522 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -2502,8 +2502,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) } else { ndlp->nlp_flag &= ~NLP_UNREG_INP; } + pmb->ctx_ndlp = NULL; } - pmb->ctx_ndlp = NULL; } /* Check security permission status on INIT_LINK mailbox command */ |