Commit affbe244 authored Jul 07, 2021 by James Smart Committed by Martin K. Petersen Jul 18, 2021

scsi: lpfc: Fix KASAN slab-out-of-bounds in lpfc_unreg_rpi() routine

In lpfc_offline_prep() an RPI is freed and nlp_rpi set to 0xFFFF before
calling lpfc_unreg_rpi().  Unfortunately, lpfc_unreg_rpi() uses nlp_rpi to
index the sli4_hba.rpi_ids[] array.

In lpfc_offline_prep(), unreg rpi before freeing the rpi.

Link: https://lore.kernel.org/r/20210707184351.67872-12-jsmart2021@gmail.com


Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent e78c006f

drivers/scsi/lpfc/lpfc_init.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -3541,6 +3541,8 @@ lpfc_offline_prep(struct lpfc_hba *phba, int mbx_action)
		spin_lock_irq(&ndlp->lock);
		ndlp->nlp_flag &= ~NLP_NPR_ADISC;
		spin_unlock_irq(&ndlp->lock);

		lpfc_unreg_rpi(vports[i], ndlp);
		/*
		* Whenever an SLI4 port goes offline, free the
		* RPI. Get a new RPI when the adapter port
		@@ -3556,7 +3558,6 @@ lpfc_offline_prep(struct lpfc_hba *phba, int mbx_action)
		lpfc_sli4_free_rpi(phba, ndlp->nlp_rpi);
		ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR;
		}
		lpfc_unreg_rpi(vports[i], ndlp);

		if (ndlp->nlp_type & NLP_FABRIC) {
		lpfc_disc_state_machine(vports[i], ndlp,