scsi: lpfc: Fix use-after-free rport memory access in lpfc_register_remote_port()
authorJustin Tee <justin.tee@broadcom.com>
Tue, 23 May 2023 18:31:58 +0000 (11:31 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 31 May 2023 22:14:19 +0000 (18:14 -0400)
commita4157aaf0fb458c867b76f6cd63cb57fa91da318
tree09894614e6461ce47c2e97a5ec51815ed8e1af43
parentfd9ffa6c747f8868640dff783bb52cb0761dba19
scsi: lpfc: Fix use-after-free rport memory access in lpfc_register_remote_port()

Due to a target port D_ID swap, it is possible for the
lpfc_register_remote_port() routine to touch post mortem fc_rport memory
when trying to access fc_rport->dd_data.

The D_ID swap causes a simultaneous call to lpfc_unregister_remote_port(),
where fc_remote_port_delete() reclaims fc_rport memory.

Remove the fc_rport->dd_data->pnode NULL assignment because the following
line reassigns ndlp->rport with an fc_rport object from
fc_remote_port_add() anyways.  The pnode nullification is superfluous.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20230523183206.7728-2-justintee8345@gmail.com
Acked-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_hbadisc.c