linux-kernel - Re: [PATCH] scsi: lpfc: Fix buffer free/clear order in deferred receive path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABPRKS-DZ9hY99QfVKuHNEt3m3AF2iLb7TP8j6+gPsGMux+Xdg@mail.gmail.com>
Date: Wed, 27 Aug 2025 14:39:25 -0700
From: Justin Tee <justintee8345@...il.com>
To: John Evans <evans1210144@...il.com>
Cc: james.smart@...adcom.com, Justin Tee <justin.tee@...adcom.com>, 
	James.Bottomley@...senpartnership.com, martin.petersen@...cle.com, 
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org, 
	stable@...r.kernel.org
Subject: Re: [PATCH] scsi: lpfc: Fix buffer free/clear order in deferred
 receive path

Hi John,

Ah okay, then how about moving where we take the ctxp->ctxlock?

diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fba2e62027b7..3d8ab456ced5 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1243,7 +1243,7 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
        struct lpfc_nvmet_tgtport *tgtp;
        struct lpfc_async_xchg_ctx *ctxp =
                container_of(rsp, struct lpfc_async_xchg_ctx, hdlrctx.fcp_req);
-       struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
+       struct rqb_dmabuf *nvmebuf;
        struct lpfc_hba *phba = ctxp->phba;
        unsigned long iflag;

@@ -1251,11 +1251,14 @@ lpfc_nvmet_defer_rcv(struct
nvmet_fc_target_port *tgtport,
        lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
                         ctxp->oxid, ctxp->size, raw_smp_processor_id());

+       spin_lock_irqsave(&ctxp->ctxlock, iflag);
+       nvmebuf = ctxp->rqb_buffer;
        if (!nvmebuf) {
                lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR,
                                "6425 Defer rcv: no buffer oxid x%x: "
                                "flg %x ste %x\n",
                                ctxp->oxid, ctxp->flag, ctxp->state);
+               spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
                return;
        }

@@ -1264,10 +1267,9 @@ lpfc_nvmet_defer_rcv(struct
nvmet_fc_target_port *tgtport,
                atomic_inc(&tgtp->rcv_fcp_cmd_defer);

        /* Free the nvmebuf since a new buffer already replaced it */
-       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
-       spin_lock_irqsave(&ctxp->ctxlock, iflag);
        ctxp->rqb_buffer = NULL;
        spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
+       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
 }

Regards,
Justin