* [PATCH] scsi: lpfc: Fix ancient double free
@ 2021-01-25 8:44 Dan Carpenter
2021-01-27 3:09 ` Martin K. Petersen
2021-01-29 19:01 ` Martin K. Petersen
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2021-01-25 8:44 UTC (permalink / raw)
To: James Smart
Cc: Dick Kennedy, James E.J. Bottomley, Martin K. Petersen,
James Bottomley, linux-scsi, kernel-janitors
The "pmb" pointer is freed at the start of the function and then freed
again in the error handling code.
Fixes: 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of SLI-3")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/scsi/lpfc/lpfc_hbadisc.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index f890b5b7e6ca..48ca4a612f80 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1155,13 +1155,14 @@ lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
struct lpfc_vport *vport = pmb->vport;
LPFC_MBOXQ_t *sparam_mb;
struct lpfc_dmabuf *sparam_mp;
+ u16 status = pmb->u.mb.mbxStatus;
int rc;
- if (pmb->u.mb.mbxStatus)
- goto out;
-
mempool_free(pmb, phba->mbox_mem_pool);
+ if (status)
+ goto out;
+
/* don't perform discovery for SLI4 loopback diagnostic test */
if ((phba->sli_rev == LPFC_SLI_REV4) &&
!(phba->hba_flag & HBA_FCOE_MODE) &&
@@ -1224,12 +1225,10 @@ lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
out:
lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
- "0306 CONFIG_LINK mbxStatus error x%x "
- "HBA state x%x\n",
- pmb->u.mb.mbxStatus, vport->port_state);
-sparam_out:
- mempool_free(pmb, phba->mbox_mem_pool);
+ "0306 CONFIG_LINK mbxStatus error x%x HBA state x%x\n",
+ status, vport->port_state);
+sparam_out:
lpfc_linkdown(phba);
lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
--
2.29.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] scsi: lpfc: Fix ancient double free
2021-01-25 8:44 [PATCH] scsi: lpfc: Fix ancient double free Dan Carpenter
@ 2021-01-27 3:09 ` Martin K. Petersen
2021-01-29 19:01 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2021-01-27 3:09 UTC (permalink / raw)
To: Dan Carpenter
Cc: James Smart, Dick Kennedy, James E.J. Bottomley,
Martin K. Petersen, James Bottomley, linux-scsi, kernel-janitors
Dan,
> The "pmb" pointer is freed at the start of the function and then freed
> again in the error handling code.
Applied to 5.12/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] scsi: lpfc: Fix ancient double free
2021-01-25 8:44 [PATCH] scsi: lpfc: Fix ancient double free Dan Carpenter
2021-01-27 3:09 ` Martin K. Petersen
@ 2021-01-29 19:01 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2021-01-29 19:01 UTC (permalink / raw)
To: Dan Carpenter, James Smart
Cc: Martin K . Petersen, Dick Kennedy, linux-scsi, kernel-janitors,
James Bottomley, James E.J. Bottomley
On Mon, 25 Jan 2021 11:44:34 +0300, Dan Carpenter wrote:
> The "pmb" pointer is freed at the start of the function and then freed
> again in the error handling code.
Applied to 5.12/scsi-queue, thanks!
[1/1] scsi: lpfc: Fix ancient double free
https://git.kernel.org/mkp/scsi/c/0be310979e5e
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-29 19:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-25 8:44 [PATCH] scsi: lpfc: Fix ancient double free Dan Carpenter
2021-01-27 3:09 ` Martin K. Petersen
2021-01-29 19:01 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).