Commit 0164d135 authored by Daniel Wagner's avatar Daniel Wagner Committed by Christoph Hellwig
Browse files

nvme-fc: do not reference lsrsp after failure 



The lsrsp object is maintained by the LLDD. The lifetime of the lsrsp
object is implicit. Because there is no explicit cleanup/free call into
the LLDD, it is not safe to assume after xml_rsp_fails, that the lsrsp
is still valid. The LLDD could have freed the object already.

With the recent changes how fcloop tracks the resources, this is the
case. Thus don't access lsrsp after xml_rsp_fails.

Signed-off-by: default avatarDaniel Wagner <wagi@kernel.org>
Reviewed-by: default avatarHannes Reinecke <hare@kernel.org>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 3466b7a6

drivers/nvme/host/fc.c

+10 −3
Original line number Diff line number Diff line
@@ -1410,9 +1410,8 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl) 
}



static void

nvme_fc_xmt_ls_rsp_done(struct nvmefc_ls_rsp *lsrsp)

nvme_fc_xmt_ls_rsp_free(struct nvmefc_ls_rcv_op *lsop)

{

	struct nvmefc_ls_rcv_op *lsop = lsrsp->nvme_fc_private;

	struct nvme_fc_rport *rport = lsop->rport;

	struct nvme_fc_lport *lport = rport->lport;

	unsigned long flags;
@@ -1433,6 +1432,14 @@ nvme_fc_xmt_ls_rsp_done(struct nvmefc_ls_rsp *lsrsp) 
	nvme_fc_rport_put(rport);

}



static void

nvme_fc_xmt_ls_rsp_done(struct nvmefc_ls_rsp *lsrsp)

{

	struct nvmefc_ls_rcv_op *lsop = lsrsp->nvme_fc_private;



	nvme_fc_xmt_ls_rsp_free(lsop);

}



static void

nvme_fc_xmt_ls_rsp(struct nvmefc_ls_rcv_op *lsop)

{
@@ -1450,7 +1457,7 @@ nvme_fc_xmt_ls_rsp(struct nvmefc_ls_rcv_op *lsop) 
		dev_warn(lport->dev,

			"LLDD rejected LS RSP xmt: LS %d status %d\n",

			w0->ls_cmd, ret);

		nvme_fc_xmt_ls_rsp_done(lsop->lsrsp);

		nvme_fc_xmt_ls_rsp_free(lsop);

		return;

	}

}