scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd

bkstratus · martinkpetersen · commit 388a49959ee4 · 2019-02-12T22:23:12.000-05:00
In qla2x00_async_tm_cmd, we reference off sp after it has been freed.  This
caused a panic on a system running a slub debug kernel. Since fcport is
passed in anyways, just use that instead.

Signed-off-by: Bill Kuzeja &lt;william.kuzeja@stratus.com&gt;
Acked-by: Giridhar Malavali &lt;gmalavali@marvell.com&gt;
Acked-by: Himanshu Madhani &lt;hmadhani@marvell.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
@@ -1785,13 +1785,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
 		/* Issue Marker IOCB */
 		qla2x00_marker(vha, vha->hw->req_q_map[0],
-		    vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun,
+		    vha->hw->rsp_q_map[0], fcport->loop_id, lun,
 		    flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
 	}
 
 done_free_sp:
 	sp->free(sp);
-	sp->fcport->flags &= ~FCF_ASYNC_SENT;
+	fcport->flags &= ~FCF_ASYNC_SENT;
 done:
 	return rval;
 }

Original file line number	Diff line number	Diff line change
`@@ -1785,13 +1785,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,`
`1785`	`1785`
`1786`	`1786`	`/* Issue Marker IOCB */`
`1787`	`1787`	`qla2x00_marker(vha, vha->hw->req_q_map[0],`
`1788`		`- vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun,`
	`1788`	`+ vha->hw->rsp_q_map[0], fcport->loop_id, lun,`
`1789`	`1789`	`flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);`
`1790`	`1790`	`}`
`1791`	`1791`
`1792`	`1792`	`done_free_sp:`
`1793`	`1793`	`sp->free(sp);`
`1794`		`- sp->fcport->flags &= ~FCF_ASYNC_SENT;`
	`1794`	`+ fcport->flags &= ~FCF_ASYNC_SENT;`
`1795`	`1795`	`done:`
`1796`	`1796`	`return rval;`
`1797`	`1797`	`}`