Commit e5785d3e authored by James Smart's avatar James Smart Committed by Martin K. Petersen
Browse files

scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() 

Commit 9816ef6e ("scsi: lpfc: Use after free in lpfc_rq_buf_free()")
was made to correct a use after free condition in lpfc_rq_buf_free().
Unfortunately, a subsequent patch cut on a tree without the fix
inadvertently reverted the fix.

Put the fix back: Move the freeing of the rqb_entry to after the print
function that references it.

Link: https://lore.kernel.org/r/20201020202719.54726-4-james.smart@broadcom.com


Fixes: 411de511 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent e7dab164

drivers/scsi/lpfc/lpfc_mem.c

+1 −1
Original line number Diff line number Diff line
@@ -721,7 +721,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp) 
	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);

	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);

	if (rc < 0) {

		(rqbp->rqb_free_buffer)(phba, rqb_entry);

		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,

				"6409 Cannot post to HRQ %d: %x %x %x "

				"DRQ %x %x\n",
@@ -731,6 +730,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp) 
				rqb_entry->hrq->entry_count,

				rqb_entry->drq->host_index,

				rqb_entry->drq->hba_index);

		(rqbp->rqb_free_buffer)(phba, rqb_entry);

	} else {

		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);

		rqbp->buffer_count++;