blob: 080a9e92b8f9423d6e138973b81b6268687e2164 [file] [log] [blame]
From b62d98c290d56278cde6c8e1eb0993889f0e5c30 Mon Sep 17 00:00:00 2001
From: "Ewan D. Milne" <>
Date: Wed, 29 Jul 2020 19:10:11 -0400
Subject: [PATCH] scsi: lpfc: nvmet: Avoid hang / use-after-free again when
destroying targetport
commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e upstream.
We cannot wait on a completion object in the lpfc_nvme_targetport structure
in the _destroy_targetport() code path because the NVMe/fc transport will
free that structure immediately after the .targetport_delete() callback.
This results in a use-after-free, and a crash if slub_debug=FZPU is
An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8
("scsi: lpfc: Correct localport timeout duration error") subsequently
changed the code to reference the completion through a pointer in the
object rather than the local stack variable. Fix this by using the stack
variable directly.
Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error")
Reviewed-by: James Smart <>
Signed-off-by: Ewan D. Milne <>
Signed-off-by: Martin K. Petersen <>
Signed-off-by: Paul Gortmaker <>
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index d74bfd264495..8a93dfa79297 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1723,7 +1723,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
tgtp->tport_unreg_cmp = &tport_unreg_cmp;
- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
+ if (!wait_for_completion_timeout(&tport_unreg_cmp,
lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
"6179 Unreg targetport %p timeout "