lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 091/879] scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
    Date
    From: James Smart <jsmart2021@gmail.com>

    [ Upstream commit 672d1cb40551ea9c95efad43ab6d45e4ab4e015f ]

    There is a potential memory leak in lpfc_ignore_els_cmpl() and
    lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT
    (lpfc_rcv_plogi()'s login_mbox).

    Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(),
    and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for
    service parameters.

    For lpfc_els_rsp_reject() failure, free both the ctx_buf for service
    parameters and the login_mbox.

    Link: https://lore.kernel.org/r/20220412222008.126521-10-jsmart2021@gmail.com
    Co-developed-by: Justin Tee <justin.tee@broadcom.com>
    Signed-off-by: Justin Tee <justin.tee@broadcom.com>
    Signed-off-by: James Smart <jsmart2021@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_nportdisc.c | 10 ++++++++--
    drivers/scsi/lpfc/lpfc_sli.c | 17 +++++++++++++++++
    2 files changed, 25 insertions(+), 2 deletions(-)

    diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
    index c4e1a07066a2..4b065c51ee1b 100644
    --- a/drivers/scsi/lpfc/lpfc_nportdisc.c
    +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
    @@ -614,9 +614,15 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
    stat.un.b.lsRjtRsnCode = LSRJT_INVALID_CMD;
    stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE;
    rc = lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb,
    - ndlp, login_mbox);
    - if (rc)
    + ndlp, login_mbox);
    + if (rc) {
    + mp = (struct lpfc_dmabuf *)login_mbox->ctx_buf;
    + if (mp) {
    + lpfc_mbuf_free(phba, mp->virt, mp->phys);
    + kfree(mp);
    + }
    mempool_free(login_mbox, phba->mbox_mem_pool);
    + }
    return 1;
    }

    diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
    index 6adaf79e67cc..09a45f8ecf3f 100644
    --- a/drivers/scsi/lpfc/lpfc_sli.c
    +++ b/drivers/scsi/lpfc/lpfc_sli.c
    @@ -12066,6 +12066,8 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
    {
    struct lpfc_nodelist *ndlp = NULL;
    IOCB_t *irsp;
    + LPFC_MBOXQ_t *mbox;
    + struct lpfc_dmabuf *mp;
    u32 ulp_command, ulp_status, ulp_word4, iotag;

    ulp_command = get_job_cmnd(phba, cmdiocb);
    @@ -12077,6 +12079,21 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
    } else {
    irsp = &rspiocb->iocb;
    iotag = irsp->ulpIoTag;
    +
    + /* It is possible a PLOGI_RJT for NPIV ports to get aborted.
    + * The MBX_REG_LOGIN64 mbox command is freed back to the
    + * mbox_mem_pool here.
    + */
    + if (cmdiocb->context_un.mbox) {
    + mbox = cmdiocb->context_un.mbox;
    + mp = (struct lpfc_dmabuf *)mbox->ctx_buf;
    + if (mp) {
    + lpfc_mbuf_free(phba, mp->virt, mp->phys);
    + kfree(mp);
    + }
    + mempool_free(mbox, phba->mbox_mem_pool);
    + cmdiocb->context_un.mbox = NULL;
    + }
    }

    /* ELS cmd tag <ulpIoTag> completes */
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-08 00:08    [W:2.165 / U:3.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site