diff options
| author | James Smart <jsmart2021@gmail.com> | 2022-06-03 19:43:25 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2022-06-08 03:38:18 +0200 |
| commit | b1b3440f437b75fb2a9b0cfe58df461e40eca474 (patch) | |
| tree | fa0714dc41f52c58e82f498d61f777ee792e277a /mm/page_io.c | |
| parent | scsi: lpfc: Address NULL pointer dereference after starget_to_rport() (diff) | |
| download | linux-b1b3440f437b75fb2a9b0cfe58df461e40eca474.tar.xz linux-b1b3440f437b75fb2a9b0cfe58df461e40eca474.zip | |
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
A use-after-free crash can occur after an ELS LOGO is aborted.
Specifically, a nodelist structure is freed and then
ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the
discovery state machine is mistakenly called a second time with
NLP_EVT_DEVICE_RM argument.
Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a
nodelist structure.
Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'mm/page_io.c')
0 files changed, 0 insertions, 0 deletions