Thread (1 message) flat view 1 message, 1 author, 2021-12-04
STALE1705d LANDED

Landed in mainline as 7576d48c64f3 on 2021-12-07.

[PATCH 3/9] lpfc: Fix lpfc_force_rscn ndlp kref imbalance

From: James Smart <hidden>
Date: 2021-12-04 00:26:57
Also in: linux-scsi
Subsystem: emulex/broadcom lpfc fc/fcoe scsi driver, scsi subsystem, the rest · Maintainers: Justin Tee, Paul Ely, "James E.J. Bottomley", "Martin K. Petersen", Linus Torvalds

Issuing lpfc_force_rscn twice results in an ndlp kref use-after-free call
trace.

A prior patch reworked the get/put handling by ensuring nlp_get was done
before WQE submission and a put was done in the completion path.
Unfortunately, the issue_els_rscn path had a piece of legacy code that
did a nlp_put, causing an imbalance on the ref counts.

Fixed by removing the unnecessary legacy code snippet.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Cc: <redacted> # v5.11+
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <redacted>
---
 drivers/scsi/lpfc/lpfc_els.c | 5 -----
 1 file changed, 5 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 5c10416c1c75..78024f11b794 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -3538,11 +3538,6 @@ lpfc_issue_els_rscn(struct lpfc_vport *vport, uint8_t retry)
 		return 1;
 	}
 
-	/* This will cause the callback-function lpfc_cmpl_els_cmd to
-	 * trigger the release of node.
-	 */
-	if (!(vport->fc_flag & FC_PT2PT))
-		lpfc_nlp_put(ndlp);
 	return 0;
 }
 
-- 
2.26.2
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help