Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] scsi: lpfc: Fix lpfc_nodelist leak when processing
 unsolicited event
To:     Daniel Wagner <dwagner@suse.de>,
        Xiyu Yang <xiyuyang19@fudan.edu.cn>
Cc:     Dick Kennedy <dick.kennedy@broadcom.com>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
        yuanxzhang@fudan.edu.cn, kjlu@umn.edu,
        Xin Tan <tanxin.ctf@gmail.com>
References: <1590416184-52592-1-git-send-email-xiyuyang19@fudan.edu.cn>
 <20200525151220.rtwmlobnkmhwhxn5@beryllium.lan>
From:   James Smart <james.smart@broadcom.com>
Message-ID: <dd782e33-db86-9457-983e-59bb75b805b4@broadcom.com>
Date:   Tue, 26 May 2020 11:11:53 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.8.0
MIME-Version: 1.0
In-Reply-To: <20200525151220.rtwmlobnkmhwhxn5@beryllium.lan>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 5/25/2020 8:12 AM, Daniel Wagner wrote:
> Hi,
>
> On Mon, May 25, 2020 at 10:16:24PM +0800, Xiyu Yang wrote:
>> In order to create or activate a new node, lpfc_els_unsol_buffer()
>> invokes lpfc_nlp_init() or lpfc_enable_node() or lpfc_nlp_get(), all of
>> them will return a reference of the specified lpfc_nodelist object to
>> "ndlp" with increased refcnt.
> lpfc_enable_node() is not changing the refcnt.
>
>> When lpfc_els_unsol_buffer() returns, local variable "ndlp" becomes
>> invalid, so the refcount should be decreased to keep refcount balanced.
>>
>> The reference counting issue happens in one exception handling path of
>> lpfc_els_unsol_buffer(). When "ndlp" in DEV_LOSS, the function forgets
>> to decrease the refcnt increased by lpfc_nlp_init() or
>> lpfc_enable_node() or lpfc_nlp_get(), causing a refcnt leak.
>>
>> Fix this issue by calling lpfc_nlp_put() when "ndlp" in DEV_LOSS.
> This sounds reasonable. At least the lpfc_nlp_init() and lpfc_nlp_get() case
> needs this. And I suppose this is also ok for the lfpc_enable_node().
>
> Reviewed-by: Daniel Wagner <dwagner@suse.de>
>
> Thanks,
> Daniel

Looked at it here and it looks good.

Reviewed-by: James Smart <james.smart@broadcom.com>

-- james