Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9816ef6e authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen
Browse files

scsi: lpfc: Use after free in lpfc_rq_buf_free() 



The error message dereferences "rqb_entry" so we need to print it first
and then free the buffer.

Fixes: 6c621a22 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarDick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent c2e8fbf9

drivers/scsi/lpfc/lpfc_mem.c

+1 −1
Original line number Diff line number Diff line
@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp) 
	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);

	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);

	if (rc < 0) {

		(rqbp->rqb_free_buffer)(phba, rqb_entry);

		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,

				"6409 Cannot post to RQ %d: %x %x\n",

				rqb_entry->hrq->queue_id,

				rqb_entry->hrq->host_index,

				rqb_entry->hrq->hba_index);

		(rqbp->rqb_free_buffer)(phba, rqb_entry);

	} else {

		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);

		rqbp->buffer_count++;