Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-17 08:31:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT

Browse Source 
There is a potential memory leak in lpfc_ignore_els_cmpl() and
lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT
(lpfc_rcv_plogi()'s login_mbox).

Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(),
and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for
service parameters.

For lpfc_els_rsp_reject() failure, free both the ctx_buf for service
parameters and the login_mbox.

Link: https://lore.kernel.org/r/20220412222008.126521-10-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
James Smart 2022-04-12 15:19:51 -07:00 committed by Martin K. Petersen
parent 577a942df3
commit 672d1cb405
2 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/scsi/lpfc/lpfc_nportdisc.c
View File

@ -614,9 +614,15 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
stat.un.b.lsRjtRsnCode = LSRJT_INVALID_CMD;
stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE;
rc = lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb,
ndlp, login_mbox);
if (rc)
ndlp, login_mbox);
if (rc) {
mp = (struct lpfc_dmabuf *)login_mbox->ctx_buf;
if (mp) {
lpfc_mbuf_free(phba, mp->virt, mp->phys);
kfree(mp);
}
mempool_free(login_mbox, phba->mbox_mem_pool);
}
return 1;
}

17
drivers/scsi/lpfc/lpfc_sli.c
View File

@ -12069,6 +12069,8 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
{
struct lpfc_nodelist *ndlp = NULL;
IOCB_t *irsp;
LPFC_MBOXQ_t *mbox;
struct lpfc_dmabuf *mp;
u32 ulp_command, ulp_status, ulp_word4, iotag;
ulp_command = get_job_cmnd(phba, cmdiocb);
@ -12080,6 +12082,21 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
} else {
irsp = &rspiocb->iocb;
iotag = irsp->ulpIoTag;
/* It is possible a PLOGI_RJT for NPIV ports to get aborted.
* The MBX_REG_LOGIN64 mbox command is freed back to the
* mbox_mem_pool here.
*/
if (cmdiocb->context_un.mbox) {
mbox = cmdiocb->context_un.mbox;
mp = (struct lpfc_dmabuf *)mbox->ctx_buf;
if (mp) {
lpfc_mbuf_free(phba, mp->virt, mp->phys);
kfree(mp);
}
mempool_free(mbox, phba->mbox_mem_pool);
cmdiocb->context_un.mbox = NULL;
}
}
/* ELS cmd tag <ulpIoTag> completes */