scsi: lpfc: Fix use-after-free mailbox cmd completion

When unloading the driver, mailbox commands may be sent without holding a
reference on the ndlp. By the time the mailbox command completes, the ndlp
may have reduced its ref counts and been freed.  The problem was reported
by KASAN.

While unregistering due to driver unload, have the completion noop'd by
setting the ndlp context NULL'd. Due to the unload, no further action was
necessary.  Also, while reviewing this path, the generic nulling of the
context after handling should be slightly moved.

Reported by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index aa4961a2caf81f4418e9c0bcc71808636bcd755f..3fb20ade90057f029cd90d84f77dc56ab9446bc0 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -4868,6 +4868,10 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                         * accept PLOGIs after unreg_rpi_cmpl
                                         */
                                        acc_plogi = 0;
+                               } else if (vport->load_flag & FC_UNLOADING) {
+                                       mbox->ctx_ndlp = NULL;
+                                       mbox->mbox_cmpl =
+                                               lpfc_sli_def_mbox_cmpl;
                                } else {
                                        mbox->ctx_ndlp = ndlp;
                                        mbox->mbox_cmpl =

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 57b4a463b5892d2f0cd0f56697d3a4b168b9a500..de5715b07522bff85e9e7e7a13f0047b9675c928 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -2502,8 +2502,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                        } else {
                                ndlp->nlp_flag &= ~NLP_UNREG_INP;
                        }
+                       pmb->ctx_ndlp = NULL;
                }
-               pmb->ctx_ndlp = NULL;
        }
 
        /* Check security permission status on INIT_LINK mailbox command */