scsi: lpfc: Fix use-after-free mailbox cmd completion

BugLink: https://bugs.launchpad.net/bugs/1837517
[ Upstream commit 9b1640686470fbbd1c6efb35ada6fe1427ea8d0f ]

When unloading the driver, mailbox commands may be sent without holding a
reference on the ndlp. By the time the mailbox command completes, the ndlp
may have reduced its ref counts and been freed.  The problem was reported
by KASAN.

While unregistering due to driver unload, have the completion noop'd by
setting the ndlp context NULL'd. Due to the unload, no further action was
necessary.  Also, while reviewing this path, the generic nulling of the
context after handling should be slightly moved.

Reported by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 2f01e5397a11d5914610f82b237ae156aa03a378..8d553cfb85aa1d40fb0c81c4013174de74881fd7 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -4879,6 +4879,10 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                         * accept PLOGIs after unreg_rpi_cmpl
                                         */
                                        acc_plogi = 0;
+                               } else if (vport->load_flag & FC_UNLOADING) {
+                                       mbox->ctx_ndlp = NULL;
+                                       mbox->mbox_cmpl =
+                                               lpfc_sli_def_mbox_cmpl;
                                } else {
                                        mbox->ctx_ndlp = ndlp;
                                        mbox->mbox_cmpl =

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 2242e9b3ca128d0e0d57e928f672cd674fe8feba..d3a942971d81877f50d8d9a795297e7259517780 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -2518,8 +2518,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                        } else {
                                ndlp->nlp_flag &= ~NLP_UNREG_INP;
                        }
+                       pmb->ctx_ndlp = NULL;
                }
-               pmb->ctx_ndlp = NULL;
        }
 
        /* Check security permission status on INIT_LINK mailbox command */