scsi: lpfc: Fix use-after-free on unused nodes after port swap
authorJames Smart <jsmart2021@gmail.com>
Mon, 12 Apr 2021 01:31:18 +0000 (18:31 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 13 Apr 2021 05:39:13 +0000 (01:39 -0400)
commit724f6b43a3492b02e2ebc88f9fb749d1405098e2
treeeb5790b6568fe9906c92488135890e3679bc2336
parent304ee43238fed517faa123e034b593905b8679f8
scsi: lpfc: Fix use-after-free on unused nodes after port swap

During target port swap, the swap logic ignores the DROPPED flag in the
nodes. As a node then moves into the UNUSED state, the reference count will
be dropped. If a node is later reused and moved out of the UNUSED state, an
access can result in a use-after-free assert.

Fix by having the port swap logic propagate the DROPPED flag when switching
nodes. This will avoid reference from being dropped.

Link: https://lore.kernel.org/r/20210412013127.2387-8-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_els.c