| From b62d98c290d56278cde6c8e1eb0993889f0e5c30 Mon Sep 17 00:00:00 2001 |
| From: "Ewan D. Milne" <emilne@redhat.com> |
| Date: Wed, 29 Jul 2020 19:10:11 -0400 |
| Subject: [PATCH] scsi: lpfc: nvmet: Avoid hang / use-after-free again when |
| destroying targetport |
| |
| commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e upstream. |
| |
| We cannot wait on a completion object in the lpfc_nvme_targetport structure |
| in the _destroy_targetport() code path because the NVMe/fc transport will |
| free that structure immediately after the .targetport_delete() callback. |
| This results in a use-after-free, and a crash if slub_debug=FZPU is |
| enabled. |
| |
| An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 |
| ("scsi: lpfc: Correct localport timeout duration error") subsequently |
| changed the code to reference the completion through a pointer in the |
| object rather than the local stack variable. Fix this by using the stack |
| variable directly. |
| |
| Link: https://lore.kernel.org/r/20200729231011.13240-1-emilne@redhat.com |
| Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") |
| Reviewed-by: James Smart <james.smart@broadcom.com> |
| Signed-off-by: Ewan D. Milne <emilne@redhat.com> |
| Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c |
| index d74bfd264495..8a93dfa79297 100644 |
| --- a/drivers/scsi/lpfc/lpfc_nvmet.c |
| +++ b/drivers/scsi/lpfc/lpfc_nvmet.c |
| @@ -1723,7 +1723,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) |
| } |
| tgtp->tport_unreg_cmp = &tport_unreg_cmp; |
| nvmet_fc_unregister_targetport(phba->targetport); |
| - if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, |
| + if (!wait_for_completion_timeout(&tport_unreg_cmp, |
| msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) |
| lpfc_printf_log(phba, KERN_ERR, LOG_NVME, |
| "6179 Unreg targetport %p timeout " |
| -- |
| 2.27.0 |
| |
