From patchwork Tue May 12 18:19:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 11543735 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B987E92A for ; Tue, 12 May 2020 18:19:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9F5B9206A3 for ; Tue, 12 May 2020 18:19:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="qUp3GgCc" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729962AbgELST0 (ORCPT ); Tue, 12 May 2020 14:19:26 -0400 Received: from userp2130.oracle.com ([156.151.31.86]:44906 "EHLO userp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725950AbgELSTZ (ORCPT ); Tue, 12 May 2020 14:19:25 -0400 Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 04CIIlLI040021; Tue, 12 May 2020 18:19:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type; s=corp-2020-01-29; bh=dYwi2oG1eCIysvZvhhpdKWvgXg6lkmSypKhPpmx3GFo=; b=qUp3GgCcMfnugz6FEENaoTy3ePTXGOHYFcdd/qUrQsN8JZvNplDvuxe5VcYJlifQlhLw y99ZpzlowV0N85Ev43PUQGwzt/8M9FvzF5chUkgS9H9ha92GbTbQM/aJBQJOOCmrToox g/Gk1gzsH0I81u5AHwgVDx8z14Gom2ZBwWhUNScNR9qud9IHC3pSAiwu/GH+aIYkpi0f SpGMtDMcyDUfSXX9jCDaFqlUBTRPRipRwwdARob5uxCOkIA+4aDhAhaAHfPnsPwT75pX wx0iZ+x1jUZ/5Vz2nRFMTDKqDl1PJg0GtlLVu++w2mNeYVy6rLVtB4/yS/+oRHoOCy4Q jg== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by userp2130.oracle.com with ESMTP id 3100yfr05g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 12 May 2020 18:19:18 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 04CIICIq047040; Tue, 12 May 2020 18:19:18 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserp3030.oracle.com with ESMTP id 3100y8r2d7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 12 May 2020 18:19:18 +0000 Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 04CIJHnn005365; Tue, 12 May 2020 18:19:17 GMT Received: from mwanda (/41.57.98.10) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 12 May 2020 11:19:16 -0700 Date: Tue, 12 May 2020 21:19:09 +0300 From: Dan Carpenter To: James Smart Cc: Dick Kennedy , "James E.J. Bottomley" , "Martin K. Petersen" , Jens Axboe , Hannes Reinecke , Paul Ely , linux-scsi@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] scsi: lpfc: Fix a use after free in lpfc_nvme_unsol_ls_handler() Message-ID: <20200512181909.GA299091@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9619 signatures=668687 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 malwarescore=0 phishscore=0 adultscore=0 suspectscore=2 mlxscore=0 mlxlogscore=795 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005120138 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9619 signatures=668687 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 lowpriorityscore=0 adultscore=0 mlxscore=0 suspectscore=2 spamscore=0 mlxlogscore=833 malwarescore=0 bulkscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005120138 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org The "axchg" pointer is dereferenced when we call the lpfc_nvme_unsol_ls_issue_abort() function. It can't be either freed or NULL. Fixes: 3a8070c567aa ("lpfc: Refactor NVME LS receive handling") Signed-off-by: Dan Carpenter Reviewed-by: James Smart --- drivers/scsi/lpfc/lpfc_sli.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 38889cb6e1996..fcf51b4192d66 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -2895,14 +2895,14 @@ lpfc_nvme_unsol_ls_handler(struct lpfc_hba *phba, struct lpfc_iocbq *piocb) (phba->nvmet_support) ? "T" : "I", ret); out_fail: - kfree(axchg); - /* recycle receive buffer */ lpfc_in_buf_free(phba, &nvmebuf->dbuf); /* If start of new exchange, abort it */ - if (fctl & FC_FC_FIRST_SEQ && !(fctl & FC_FC_EX_CTX)) + if (axchg && (fctl & FC_FC_FIRST_SEQ) && !(fctl & FC_FC_EX_CTX)) lpfc_nvme_unsol_ls_issue_abort(phba, axchg, sid, oxid); + + kfree(axchg); } /**