Commit 9c303496 authored by Justin Tee's avatar Justin Tee Committed by Martin K. Petersen
Browse files

scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo 



When a dev_loss_tmo event occurs, an ndlp lock is taken before checking
nlp_flag for NLP_DROPPED.  There is an attempt to restore the ndlp lock
when exiting the if statement, but the nlp_put kref could be the final
decrement causing a use-after-free memory access on a released ndlp object.

Instead of trying to reacquire the ndlp lock after checking nlp_flag, just
return after calling nlp_put.

Signed-off-by: default avatarJustin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20230908211852.37576-1-justintee8345@gmail.com


Reviewed-by: default avatar"Ewan D. Milne" <emilne@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 7dcc683d

drivers/scsi/lpfc/lpfc_hbadisc.c

+1 −1
Original line number Diff line number Diff line
@@ -203,7 +203,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) 
			ndlp->nlp_flag |= NLP_DROPPED;

			spin_unlock_irqrestore(&ndlp->lock, iflags);

			lpfc_nlp_put(ndlp);

			spin_lock_irqsave(&ndlp->lock, iflags);

			return;

		}



		spin_unlock_irqrestore(&ndlp->lock, iflags);