Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 612872ca authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by James Bottomley
Browse files

lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2() 



If the bf_get() call in lpfc_mbx_cmpl_rdp_page_a2() does succeeds, execution
continues normally and mp gets kfree()d.

If the subsequent call to lpfc_sli_issue_mbox() fails execution jumps to the
error label where lpfc_mbuf_free() is called with mp->virt and mp->phys as
function arguments. This is the use after free. Following the use after free mp
gets kfree()d again which is a double free.

Signed-off-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Acked-by: default avatarJames Smart <james.smart@avagotech.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent 6f3d828f

drivers/scsi/lpfc/lpfc_mbox.c

+4 −3
Original line number Diff line number Diff line
@@ -2284,7 +2284,7 @@ lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox) 
			(struct lpfc_rdp_context *)(mbox->context2);



	if (bf_get(lpfc_mqe_status, &mbox->u.mqe))

		goto error;

		goto error_mbuf_free;



	lpfc_sli_bemem_bcopy(mp->virt, &rdp_context->page_a2,

				DMP_SFF_PAGE_A2_SIZE);
@@ -2299,13 +2299,14 @@ lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox) 
	mbox->mbox_cmpl = lpfc_mbx_cmpl_rdp_link_stat;

	mbox->context2 = (struct lpfc_rdp_context *) rdp_context;

	if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) == MBX_NOT_FINISHED)

		goto error;

		goto error_cmd_free;



	return;



error:

error_mbuf_free:

	lpfc_mbuf_free(phba, mp->virt, mp->phys);

	kfree(mp);

error_cmd_free:

	lpfc_sli4_mbox_cmd_free(phba, mbox);

	rdp_context->cmpl(phba, rdp_context, FAILURE);

}