]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
authorJames Smart <jsmart2021@gmail.com>
Fri, 3 Jun 2022 17:43:25 +0000 (10:43 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Jun 2022 12:21:57 +0000 (14:21 +0200)
commit073f9486928db574b7fbf54e89913f4db2b6de7e
tree1e245f091a0cb2ba6320f7b9e0886615f7c717e0
parent56bf1e94960e8e0fa3274a55fae077a505164a67
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted

[ Upstream commit 48fe9f2113b432499f9f5b9407112ac88160c029 ]

A use-after-free crash can occur after an ELS LOGO is aborted.

Specifically, a nodelist structure is freed and then
ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the
discovery state machine is mistakenly called a second time with
NLP_EVT_DEVICE_RM argument.

Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a
nodelist structure.

Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/scsi/lpfc/lpfc_els.c