[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.4 012/135] scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event
From: Xiyu Yang <>

[ Upstream commit 7217e6e694da3aae6d17db8a7f7460c8d4817ebf ]

In order to create or activate a new node, lpfc_els_unsol_buffer() invokes
lpfc_nlp_init() or lpfc_enable_node() or lpfc_nlp_get(), all of them will
return a reference of the specified lpfc_nodelist object to "ndlp" with
increased refcnt.

When lpfc_els_unsol_buffer() returns, local variable "ndlp" becomes
invalid, so the refcount should be decreased to keep refcount balanced.

The reference counting issue happens in one exception handling path of
lpfc_els_unsol_buffer(). When "ndlp" in DEV_LOSS, the function forgets to
decrease the refcnt increased by lpfc_nlp_init() or lpfc_enable_node() or
lpfc_nlp_get(), causing a refcnt leak.

Fix this issue by calling lpfc_nlp_put() when "ndlp" in DEV_LOSS.

Reviewed-by: Daniel Wagner <>
Reviewed-by: James Smart <>
Signed-off-by: Xiyu Yang <>
Signed-off-by: Xin Tan <>
Signed-off-by: Martin K. Petersen <>
Signed-off-by: Sasha Levin <>
drivers/scsi/lpfc/lpfc_els.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 530b7df21322a..315dd25a0c44e 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7315,6 +7315,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
+ if (newnode)
+ lpfc_nlp_put(ndlp);
goto dropit;
 \ /
  Last update: 2020-06-29 23:11    [W:0.496 / U:18.508 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site