scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
authorJames Smart <jsmart2021@gmail.com>
Tue, 12 Apr 2022 22:19:51 +0000 (15:19 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 19 Apr 2022 02:48:45 +0000 (22:48 -0400)
There is a potential memory leak in lpfc_ignore_els_cmpl() and
lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT
(lpfc_rcv_plogi()'s login_mbox).

Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(),
and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for
service parameters.

For lpfc_els_rsp_reject() failure, free both the ctx_buf for service
parameters and the login_mbox.

Link: https://lore.kernel.org/r/20220412222008.126521-10-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/lpfc/lpfc_nportdisc.c
drivers/scsi/lpfc/lpfc_sli.c

index c4e1a07066a2eef7627ce9adda321e630168e203..4b065c51ee1b0ccdd59d87f7783e9b18baadde2d 100644 (file)
@@ -614,9 +614,15 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
                stat.un.b.lsRjtRsnCode = LSRJT_INVALID_CMD;
                stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE;
                rc = lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb,
-                       ndlp, login_mbox);
-               if (rc)
+                                        ndlp, login_mbox);
+               if (rc) {
+                       mp = (struct lpfc_dmabuf *)login_mbox->ctx_buf;
+                       if (mp) {
+                               lpfc_mbuf_free(phba, mp->virt, mp->phys);
+                               kfree(mp);
+                       }
                        mempool_free(login_mbox, phba->mbox_mem_pool);
+               }
                return 1;
        }
 
index 28d8ded9e7e1560a3251a72d9ff5245f2cab8113..ca7766940b4e6e3c03e094f628d491ff7e2e3ab4 100644 (file)
@@ -12069,6 +12069,8 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 {
        struct lpfc_nodelist *ndlp = NULL;
        IOCB_t *irsp;
+       LPFC_MBOXQ_t *mbox;
+       struct lpfc_dmabuf *mp;
        u32 ulp_command, ulp_status, ulp_word4, iotag;
 
        ulp_command = get_job_cmnd(phba, cmdiocb);
@@ -12080,6 +12082,21 @@ lpfc_ignore_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
        } else {
                irsp = &rspiocb->iocb;
                iotag = irsp->ulpIoTag;
+
+               /* It is possible a PLOGI_RJT for NPIV ports to get aborted.
+                * The MBX_REG_LOGIN64 mbox command is freed back to the
+                * mbox_mem_pool here.
+                */
+               if (cmdiocb->context_un.mbox) {
+                       mbox = cmdiocb->context_un.mbox;
+                       mp = (struct lpfc_dmabuf *)mbox->ctx_buf;
+                       if (mp) {
+                               lpfc_mbuf_free(phba, mp->virt, mp->phys);
+                               kfree(mp);
+                       }
+                       mempool_free(mbox, phba->mbox_mem_pool);
+                       cmdiocb->context_un.mbox = NULL;
+               }
        }
 
        /* ELS cmd tag <ulpIoTag> completes */