lkml.org 
[lkml]   [2020]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 058/266] scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    [ Upstream commit 7217e6e694da3aae6d17db8a7f7460c8d4817ebf ]

    In order to create or activate a new node, lpfc_els_unsol_buffer() invokes
    lpfc_nlp_init() or lpfc_enable_node() or lpfc_nlp_get(), all of them will
    return a reference of the specified lpfc_nodelist object to "ndlp" with
    increased refcnt.

    When lpfc_els_unsol_buffer() returns, local variable "ndlp" becomes
    invalid, so the refcount should be decreased to keep refcount balanced.

    The reference counting issue happens in one exception handling path of
    lpfc_els_unsol_buffer(). When "ndlp" in DEV_LOSS, the function forgets to
    decrease the refcnt increased by lpfc_nlp_init() or lpfc_enable_node() or
    lpfc_nlp_get(), causing a refcnt leak.

    Fix this issue by calling lpfc_nlp_put() when "ndlp" in DEV_LOSS.

    Link: https://lore.kernel.org/r/1590416184-52592-1-git-send-email-xiyuyang19@fudan.edu.cn
    Reviewed-by: Daniel Wagner <dwagner@suse.de>
    Reviewed-by: James Smart <james.smart@broadcom.com>
    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_els.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
    index 66f8867dd837..94d8f2834100 100644
    --- a/drivers/scsi/lpfc/lpfc_els.c
    +++ b/drivers/scsi/lpfc/lpfc_els.c
    @@ -8394,6 +8394,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
    spin_lock_irq(shost->host_lock);
    if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
    spin_unlock_irq(shost->host_lock);
    + if (newnode)
    + lpfc_nlp_put(ndlp);
    goto dropit;
    }
    spin_unlock_irq(shost->host_lock);
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-18 04:27    [W:5.100 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site