All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Smart <james.smart@broadcom.com>
To: linux-scsi@vger.kernel.org
Cc: James Smart <james.smart@broadcom.com>, stable@vger.kernel.org
Subject: [PATCH 3/9] lpfc: Re-fix use after free in lpfc_rq_buf_free()
Date: Tue, 20 Oct 2020 13:27:13 -0700	[thread overview]
Message-ID: <20201020202719.54726-4-james.smart@broadcom.com> (raw)
In-Reply-To: <20201020202719.54726-1-james.smart@broadcom.com>

[-- Attachment #1: Type: text/plain, Size: 1445 bytes --]

A commit (9816ef6ecbc1) was made to correct a use after free condition
in lpfc_rq_buf_free(). Unfortunately, a subsequent patch cut on a tree
without the fix inadvertantly reverted the fix.

Put the fix back:  move the freeing of the rqb_entry to after the print
function that references it.

Fixes: 	411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: James Smart <james.smart@broadcom.com>
---
 drivers/scsi/lpfc/lpfc_mem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 79386e294fb9..be54fbf5146f 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -721,7 +721,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
 	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
 	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
 	if (rc < 0) {
-		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"6409 Cannot post to HRQ %d: %x %x %x "
 				"DRQ %x %x\n",
@@ -731,6 +730,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
 				rqb_entry->hrq->entry_count,
 				rqb_entry->drq->host_index,
 				rqb_entry->drq->hba_index);
+		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 	} else {
 		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
 		rqbp->buffer_count++;
-- 
2.26.2


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4163 bytes --]

  parent reply	other threads:[~2020-10-20 20:27 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-20 20:27 [PATCH 0/9] lpfc: Update lpfc to revision 12.8.0.5 James Smart
2020-10-20 20:27 ` [PATCH 1/9] lpfc: fix invalid sleeping context in lpfc_sli4_nvmet_alloc James Smart
2020-10-20 20:27 ` [PATCH 2/9] lpfc: fix scheduling call while in softirq context in lpfc_unreg_rpi James Smart
2020-10-20 20:27 ` James Smart [this message]
2020-10-20 20:27 ` [PATCH 4/9] lpfc: Removed unused macros in lpfc_attr.c James Smart
2020-10-20 20:27 ` [PATCH 5/9] lpfc: Fix duplicate wq_create_version check James Smart
2020-10-20 20:27 ` [PATCH 6/9] lpfc: Enlarge max_sectors in scsi templates James Smart
2020-10-20 20:27 ` [PATCH 7/9] lpfc: Add FDMI Vendor MIB support James Smart
2020-10-20 20:27 ` [PATCH 8/9] lpfc: Reject CT request for MIB commands James Smart
2020-10-20 20:27 ` [PATCH 9/9] lpfc: Update lpfc version to 12.8.0.5 James Smart
2020-10-27  1:43 ` [PATCH 0/9] lpfc: Update lpfc to revision 12.8.0.5 Martin K. Petersen
2020-11-11  2:59 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201020202719.54726-4-james.smart@broadcom.com \
    --to=james.smart@broadcom.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.