]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: lpfc: Fix use-after-free mailbox cmd completion
authorJames Smart <jsmart2021@gmail.com>
Tue, 12 Mar 2019 23:30:06 +0000 (16:30 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 19 Mar 2019 16:57:01 +0000 (12:57 -0400)
commit47d6c3eb5090e85cbb73a06612530fb73256c13b
tree8584d1a75f75b873d9b546bd6ed3a55cf47eeb36
parentb05e8234294bb8a7076344531aa5656a50444d7d
scsi: lpfc: Fix use-after-free mailbox cmd completion

When unloading the driver, mailbox commands may be sent without holding a
reference on the ndlp. By the time the mailbox command completes, the ndlp
may have reduced its ref counts and been freed.  The problem was reported
by KASAN.

While unregistering due to driver unload, have the completion noop'd by
setting the ndlp context NULL'd. Due to the unload, no further action was
necessary.  Also, while reviewing this path, the generic nulling of the
context after handling should be slightly moved.

Reported by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_hbadisc.c
drivers/scsi/lpfc/lpfc_sli.c