]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
authorEwan D. Milne <emilne@redhat.com>
Wed, 29 Jul 2020 23:10:11 +0000 (19:10 -0400)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 5 Aug 2020 00:56:56 +0000 (20:56 -0400)
commit9cca54c698e2b3b29cefacad0fd20256ce25256a
tree0aeb94dddc14642211877f72ba845c2b58923d37
parent0e9ce49ee5c562643c30e616bd8b5bbf64459c2a
scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport

We cannot wait on a completion object in the lpfc_nvme_targetport structure
in the _destroy_targetport() code path because the NVMe/fc transport will
free that structure immediately after the .targetport_delete() callback.
This results in a use-after-free, and a crash if slub_debug=FZPU is
enabled.

An earlier fix put put the completion on the stack, but commit fe31795ef859
("scsi: lpfc: Correct localport timeout duration error") subsequently
changed the code to reference the completion through a pointer in the
object rather than the local stack variable.  Fix this by using the stack
variable directly.

Link: https://lore.kernel.org/r/20200729231011.13240-1-emilne@redhat.com
Fixes: fe31795ef859 ("scsi: lpfc: Correct localport timeout duration error")
Reviewed-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_nvmet.c