Received: by 10.223.185.116 with SMTP id b49csp1066075wrg; Fri, 23 Feb 2018 11:17:43 -0800 (PST) X-Google-Smtp-Source: AH8x226rIQEtWm0B65P3Fq/ODvQSDpUsVDjIRawSXi4KUq5wzcbPAMx00dbSrtghQ6EwF7J+Wjl/ X-Received: by 2002:a17:902:654a:: with SMTP id d10-v6mr2587161pln.117.1519413463387; Fri, 23 Feb 2018 11:17:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519413463; cv=none; d=google.com; s=arc-20160816; b=Uh/0K4F03O0Q+H1z9U5bJJP4uQ/4s524RpZSwCcxJhcy9u/FNmtN9Xk0Q+rlf9Xl33 V8LgNwSjlMYZsHkOgcfnhnDHt3fs8iD4JoBhQeNrNKQdeDKqn3sy/Y+NVD3Pqd40rfMn Dh4TF+pFONHgtZ3WzovaJF/wt+jIWlVXu8PX0D1PxbReUT9Il9CRFyHWnz3snJKxaZ2a 534xUHzVU24pvyYGiqabLq0k6Jy+5sSKkAa4DScgl6KWM3IXg9VRDX5makC40zAT+unA bdNOCQBQbHxuDLegWCRQSqBhdm2sYeAL0pDdbp/WqL2U6vhu5w+3m5vH/XSkbCfXjXMR YbUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=PQVqScq2UkopbTcSFz/gRAqyjXsY046703oGofLGU+4=; b=Y78AyAjsP12mIpi02sgA6BCGIOo8vNFVZ6AfzV+/JWHA81yuafPb3JqMaGLGK9NTAG zxNUQX2pdnbcu2g8sYECQoiGbiXunqdHO/tLL+5SocJjTjpWT4B2gXK+kvH7oN504zPX q0mOXg/rZIYsy7GQDWUjRX3m94JnfmkgrgFEPWOmjLq8IsZ0vVPJ1qHzkuUibqlNoPsw GxAcXjrjODEGlO6XZMj6Lv6edBI3YBbnT3wZX3ka7KeqTxjfj3Np2xuL0GkbKSURt3TQ 68sF5GZXeY2IYrdyNz0TQv+T3fisDiMmHfjxY9EX/qvF6QYu2qUssCQK0TmO+1xQyOpQ JapQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a34-v6si2189744pld.505.2018.02.23.11.17.28; Fri, 23 Feb 2018 11:17:43 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965109AbeBWSzP (ORCPT + 99 others); Fri, 23 Feb 2018 13:55:15 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:48046 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965070AbeBWSzF (ORCPT ); Fri, 23 Feb 2018 13:55:05 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id A49B81244; Fri, 23 Feb 2018 18:55:04 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Dick Kennedy , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.14 128/159] scsi: lpfc: Use after free in lpfc_rq_buf_free() Date: Fri, 23 Feb 2018 19:27:16 +0100 Message-Id: <20180223170758.626342040@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter [ Upstream commit 9816ef6ecbc102b9bcbb1d83e12c7fb19924f38c ] The error message dereferences "rqb_entry" so we need to print it first and then free the buffer. Fixes: 6c621a2229b0 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context") Signed-off-by: Dan Carpenter Acked-by: Dick Kennedy Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/lpfc/lpfc_mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/lpfc/lpfc_mem.c +++ b/drivers/scsi/lpfc/lpfc_mem.c @@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys); rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe); if (rc < 0) { - (rqbp->rqb_free_buffer)(phba, rqb_entry); lpfc_printf_log(phba, KERN_ERR, LOG_INIT, "6409 Cannot post to RQ %d: %x %x\n", rqb_entry->hrq->queue_id, rqb_entry->hrq->host_index, rqb_entry->hrq->hba_index); + (rqbp->rqb_free_buffer)(phba, rqb_entry); } else { list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list); rqbp->buffer_count++;