libfc: Fix fc_exch_recv_req() error path
authorBart Van Assche <bart.vanassche@sandisk.com>
Fri, 5 Jun 2015 21:20:46 +0000 (14:20 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 13 Sep 2015 16:07:42 +0000 (09:07 -0700)
commit9ddd673ff000280299c0ae654f33c519aa52789b
tree473e6dfdad03c90c83bc527718fef3e1fa1300ce
parent3f52099b9579b39c8e6bfbbd1a92edc303c6d9fd
libfc: Fix fc_exch_recv_req() error path

commit f6979adeaab578f8ca14fdd32b06ddee0d9d3314 upstream.

Due to patch "libfc: Do not invoke the response handler after
fc_exch_done()" (commit ID 7030fd62) the lport_recv() call
in fc_exch_recv_req() is passed a dangling pointer. Avoid this
by moving the fc_frame_free() call from fc_invoke_resp() to its
callers. This patch fixes the following crash:

general protection fault: 0000 [#3] PREEMPT SMP
RIP: fc_lport_recv_req+0x72/0x280 [libfc]
Call Trace:
 fc_exch_recv+0x642/0xde0 [libfc]
 fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe]
 kthread+0x10a/0x120
 ret_from_fork+0x42/0x70

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/libfc/fc_exch.c