8e9a3250dc
There are several code paths where the following sequence occurs: - An ndlp pointer is assigned to an iocb via a nlp_get() - An attempt is made to issue the iocb, but it fails - The failure case does a put on the ndlp then calls lpfc_els_free_iocb() The put may free the ndlp structure, but the els_free_iocb may reference the now-stale ndlp pointer and cause a crash. Fix by ensuring that the lpfc_els_free_iocb() occurs before the lpfc_nlp_put(). While fixing, refactor the code to better ensure this calling sequence. Link: https://lore.kernel.org/r/20210301171821.3427-11-jsmart2021@gmail.com Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com> Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com> Signed-off-by: James Smart <jsmart2021@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
||
---|---|---|
.. | ||
lpfc_attr.c | ||
lpfc_attr.h | ||
lpfc_bsg.c | ||
lpfc_bsg.h | ||
lpfc_compat.h | ||
lpfc_crtn.h | ||
lpfc_ct.c | ||
lpfc_debugfs.c | ||
lpfc_debugfs.h | ||
lpfc_disc.h | ||
lpfc_els.c | ||
lpfc_hbadisc.c | ||
lpfc_hw4.h | ||
lpfc_hw.h | ||
lpfc_ids.h | ||
lpfc_init.c | ||
lpfc_logmsg.h | ||
lpfc_mbox.c | ||
lpfc_mem.c | ||
lpfc_nl.h | ||
lpfc_nportdisc.c | ||
lpfc_nvme.c | ||
lpfc_nvme.h | ||
lpfc_nvmet.c | ||
lpfc_scsi.c | ||
lpfc_scsi.h | ||
lpfc_sli4.h | ||
lpfc_sli.c | ||
lpfc_sli.h | ||
lpfc_version.h | ||
lpfc_vport.c | ||
lpfc_vport.h | ||
lpfc.h | ||
Makefile |