linux-kernel - Re: [PATCH] scsi: lpfc: Fix buffer free/clear order in deferred receive path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+KyXhJh3sGb9rzY7jPEAkSpjvhAV+DG_qRzDdBs4q7BZWAV0Q@mail.gmail.com>
Date: Thu, 28 Aug 2025 12:45:03 +0800
From: John Evans <evans1210144@...il.com>
To: Justin Tee <justintee8345@...il.com>
Cc: james.smart@...adcom.com, Justin Tee <justin.tee@...adcom.com>, 
	James.Bottomley@...senpartnership.com, martin.petersen@...cle.com, 
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org, 
	stable@...r.kernel.org
Subject: Re: [PATCH] scsi: lpfc: Fix buffer free/clear order in deferred
 receive path

> Hi John,
>
> Ah okay, then how about moving where we take the ctxp->ctxlock?
>
> diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
> index fba2e62027b7..3d8ab456ced5 100644
> --- a/drivers/scsi/lpfc/lpfc_nvmet.c
> +++ b/drivers/scsi/lpfc/lpfc_nvmet.c
> @@ -1243,7 +1243,7 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
>         struct lpfc_nvmet_tgtport *tgtp;
>         struct lpfc_async_xchg_ctx *ctxp =
>                 container_of(rsp, struct lpfc_async_xchg_ctx, hdlrctx.fcp_req);
> -       struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
> +       struct rqb_dmabuf *nvmebuf;
>         struct lpfc_hba *phba = ctxp->phba;
>         unsigned long iflag;
>
> @@ -1251,11 +1251,14 @@ lpfc_nvmet_defer_rcv(struct
> nvmet_fc_target_port *tgtport,
>         lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
>                          ctxp->oxid, ctxp->size, raw_smp_processor_id());
>
> +       spin_lock_irqsave(&ctxp->ctxlock, iflag);
> +       nvmebuf = ctxp->rqb_buffer;
>         if (!nvmebuf) {
>                 lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR,
>                                 "6425 Defer rcv: no buffer oxid x%x: "
>                                 "flg %x ste %x\n",
>                                 ctxp->oxid, ctxp->flag, ctxp->state);
> +               spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
>                 return;
>         }
>
> @@ -1264,10 +1267,9 @@ lpfc_nvmet_defer_rcv(struct
> nvmet_fc_target_port *tgtport,
>                 atomic_inc(&tgtp->rcv_fcp_cmd_defer);
>
>         /* Free the nvmebuf since a new buffer already replaced it */
> -       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
> -       spin_lock_irqsave(&ctxp->ctxlock, iflag);
>         ctxp->rqb_buffer = NULL;
>         spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
> +       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
>  }
>
> Regards,
> Justin
Hi Justin,

Fixed in the patch v2.
Thanks!

Regards,
John