All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Smart <jsmart2021@gmail.com>
To: linux-scsi@vger.kernel.org
Cc: James Smart <jsmart2021@gmail.com>,
	stable@vger.kernel.org, Justin Tee <justin.tee@broadcom.com>
Subject: [PATCH 3/9] lpfc: Fix lpfc_force_rscn ndlp kref imbalance
Date: Fri,  3 Dec 2021 16:26:38 -0800	[thread overview]
Message-ID: <20211204002644.116455-4-jsmart2021@gmail.com> (raw)
In-Reply-To: <20211204002644.116455-1-jsmart2021@gmail.com>

Issuing lpfc_force_rscn twice results in an ndlp kref use-after-free call
trace.

A prior patch reworked the get/put handling by ensuring nlp_get was done
before WQE submission and a put was done in the completion path.
Unfortunately, the issue_els_rscn path had a piece of legacy code that
did a nlp_put, causing an imbalance on the ref counts.

Fixed by removing the unnecessary legacy code snippet.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Cc: <stable@vger.kernel.org> # v5.11+
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
---
 drivers/scsi/lpfc/lpfc_els.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 5c10416c1c75..78024f11b794 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -3538,11 +3538,6 @@ lpfc_issue_els_rscn(struct lpfc_vport *vport, uint8_t retry)
 		return 1;
 	}
 
-	/* This will cause the callback-function lpfc_cmpl_els_cmd to
-	 * trigger the release of node.
-	 */
-	if (!(vport->fc_flag & FC_PT2PT))
-		lpfc_nlp_put(ndlp);
 	return 0;
 }
 
-- 
2.26.2


  parent reply	other threads:[~2021-12-04  0:26 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-04  0:26 [PATCH 0/9] lpfc: Update lpfc to revision 14.0.0.4 James Smart
2021-12-04  0:26 ` [PATCH 1/9] lpfc: Fix leaked lpfc_dmabuf mbox allocations with npiv James Smart
2021-12-04  0:26 ` [PATCH 2/9] lpfc: Change return code on ios received during link bounce James Smart
2021-12-04  0:26 ` James Smart [this message]
2021-12-04  0:26 ` [PATCH 4/9] lpfc: Fix NPIV port deletion crash James Smart
2021-12-04  0:26 ` [PATCH 5/9] lpfc: Trigger SLI4 firmware dump before doing driver cleanup James Smart
2021-12-04  0:26 ` [PATCH 6/9] lpfc: Adjust CMF total bytes and rxmonitor James Smart
2021-12-04  0:26 ` [PATCH 7/9] lpfc: Cap CMF read bytes to MBPI James Smart
2021-12-04  0:26 ` [PATCH 8/9] lpfc: Add additional debugfs support for CMF James Smart
2021-12-04  0:26 ` [PATCH 9/9] lpfc: Update lpfc version to 14.0.0.4 James Smart
2021-12-07  3:35 ` [PATCH 0/9] lpfc: Update lpfc to revision 14.0.0.4 Martin K. Petersen
2021-12-14  4:40 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211204002644.116455-4-jsmart2021@gmail.com \
    --to=jsmart2021@gmail.com \
    --cc=justin.tee@broadcom.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.