diff options
author | James Smart <jsmart2021@gmail.com> | 2022-04-13 01:19:50 +0300 |
---|---|---|
committer | Martin K. Petersen <martin.petersen@oracle.com> | 2022-04-19 05:48:44 +0300 |
commit | 577a942df3de2666f6947bdd3a5c9e8d30073424 (patch) | |
tree | 38accafe6d4ae4050fb2ff5fb1f4c52fc0fdec6c /drivers/scsi/lpfc/lpfc_nportdisc.c | |
parent | 3483a44bdfb475432081a27b38ea7fb8305814af (diff) | |
download | linux-577a942df3de2666f6947bdd3a5c9e8d30073424.tar.xz |
scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
If lpfc_issue_els_flogi() fails and returns non-zero status, the node
reference count is decremented to trigger the release of the nodelist
structure. However, if there is a prior registration or dev-loss-evt work
pending, the node may be released prematurely. When dev-loss-evt
completes, the released node is referenced causing a use-after-free null
pointer dereference.
Similarly, when processing non-zero ELS PLOGI completion status in
lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport
registration before triggering node removal. If dev-loss-evt work is
pending, the node may be released prematurely and a subsequent call to
lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference.
Add test for pending dev-loss before decrementing the node reference count
for FLOGI, PLOGI, PRLI, and ADISC handling.
Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/lpfc/lpfc_nportdisc.c')
0 files changed, 0 insertions, 0 deletions