lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 017/191] scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    [ Upstream commit 7217e6e694da3aae6d17db8a7f7460c8d4817ebf ]

    In order to create or activate a new node, lpfc_els_unsol_buffer() invokes
    lpfc_nlp_init() or lpfc_enable_node() or lpfc_nlp_get(), all of them will
    return a reference of the specified lpfc_nodelist object to "ndlp" with
    increased refcnt.

    When lpfc_els_unsol_buffer() returns, local variable "ndlp" becomes
    invalid, so the refcount should be decreased to keep refcount balanced.

    The reference counting issue happens in one exception handling path of
    lpfc_els_unsol_buffer(). When "ndlp" in DEV_LOSS, the function forgets to
    decrease the refcnt increased by lpfc_nlp_init() or lpfc_enable_node() or
    lpfc_nlp_get(), causing a refcnt leak.

    Fix this issue by calling lpfc_nlp_put() when "ndlp" in DEV_LOSS.

    Link: https://lore.kernel.org/r/1590416184-52592-1-git-send-email-xiyuyang19@fudan.edu.cn
    Reviewed-by: Daniel Wagner <dwagner@suse.de>
    Reviewed-by: James Smart <james.smart@broadcom.com>
    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_els.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
    index 4901bf24916b5..09dbf3021bb0b 100644
    --- a/drivers/scsi/lpfc/lpfc_els.c
    +++ b/drivers/scsi/lpfc/lpfc_els.c
    @@ -7606,6 +7606,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
    spin_lock_irq(shost->host_lock);
    if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
    spin_unlock_irq(shost->host_lock);
    + if (newnode)
    + lpfc_nlp_put(ndlp);
    goto dropit;
    }
    spin_unlock_irq(shost->host_lock);
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-29 22:20    [W:3.561 / U:1.408 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site