tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()

Commit 9816ef6ecbc1 ("scsi: lpfc: Use after free in lpfc_rq_buf_free()")
was made to correct a use after free condition in lpfc_rq_buf_free().
Unfortunately, a subsequent patch cut on a tree without the fix
inadvertently reverted the fix.

Put the fix back: Move the freeing of the rqb_entry to after the print
function that references it.

Link: https://lore.kernel.org/r/20201020202719.54726-4-james.smart@broadcom.com
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

James Smart and committed by
Martin K. Petersen e5785d3e e7dab164

+1 -1
+1 -1
drivers/scsi/lpfc/lpfc_mem.c
··· 721 721 drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys); 722 722 rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe); 723 723 if (rc < 0) { 724 - (rqbp->rqb_free_buffer)(phba, rqb_entry); 725 724 lpfc_printf_log(phba, KERN_ERR, LOG_INIT, 726 725 "6409 Cannot post to HRQ %d: %x %x %x " 727 726 "DRQ %x %x\n", ··· 730 731 rqb_entry->hrq->entry_count, 731 732 rqb_entry->drq->host_index, 732 733 rqb_entry->drq->hba_index); 734 + (rqbp->rqb_free_buffer)(phba, rqb_entry); 733 735 } else { 734 736 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list); 735 737 rqbp->buffer_count++;