lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 672/717] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
    Date
    From: James Smart <james.smart@broadcom.com>

    commit e5785d3ec32f5f44dd88cd7b398e496742630469 upstream.

    Commit 9816ef6ecbc1 ("scsi: lpfc: Use after free in lpfc_rq_buf_free()")
    was made to correct a use after free condition in lpfc_rq_buf_free().
    Unfortunately, a subsequent patch cut on a tree without the fix
    inadvertently reverted the fix.

    Put the fix back: Move the freeing of the rqb_entry to after the print
    function that references it.

    Link: https://lore.kernel.org/r/20201020202719.54726-4-james.smart@broadcom.com
    Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
    Cc: <stable@vger.kernel.org> # v4.17+
    Signed-off-by: James Smart <james.smart@broadcom.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/scsi/lpfc/lpfc_mem.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/scsi/lpfc/lpfc_mem.c
    +++ b/drivers/scsi/lpfc/lpfc_mem.c
    @@ -721,7 +721,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
    drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
    rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
    if (rc < 0) {
    - (rqbp->rqb_free_buffer)(phba, rqb_entry);
    lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
    "6409 Cannot post to HRQ %d: %x %x %x "
    "DRQ %x %x\n",
    @@ -731,6 +730,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
    rqb_entry->hrq->entry_count,
    rqb_entry->drq->host_index,
    rqb_entry->drq->hba_index);
    + (rqbp->rqb_free_buffer)(phba, rqb_entry);
    } else {
    list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
    rqbp->buffer_count++;

    \
     
     \ /
      Last update: 2020-12-28 15:34    [W:2.457 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site