Re: [PATCH] scsi: lpfc: fix ndlp use-after-free in RLS accept callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] scsi: lpfc: inaccurate Fixes tag in commit message for lpfc_els_rsp_rls_acc()
--

commit 8109741dc29cffda7f87382c25b20f6a9dd30b92
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: lpfc: fix ndlp use-after-free in RLS accept callback

This commit fixes a use-after-free of ndlp in lpfc_els_rsp_rls_acc() by
delaying lpfc_nlp_put(ndlp) until after the IOCB reference on ndlp has
been acquired, and releasing it on earlier error paths.

>     scsi: lpfc: fix ndlp use-after-free in RLS accept callback
>     
>     lpfc_els_rcv_rls() takes a reference on the ndlp for the pending
>     MBX_READ_LNK_STAT command.  lpfc_els_rsp_rls_acc() drops that
>     reference right after building the ACC IOCB, but then keeps
>     dereferencing ndlp in the trace message and takes a fresh reference
>     for the IOCB.
>     
>     The node can be removed from the nodelist while the mailbox is
>     pending, so the put may be the last one and release ndlp through
>     lpfc_nlp_release().  The later ndlp->vport, ndlp->nlp_DID and
>     lpfc_nlp_get() calls then touch freed memory.
>     
>     Move the put after the reference for the IOCB has been acquired, and
>     release it on the paths that bail out before that point.
>     
>     Fixes: 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS commands")
>     Cc: stable@vger.kernel.org
>     Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>     Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

[Severity: Low]
In commit 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS
commands"), lpfc_prep_els_iocb() itself acquired the IOCB reference on
ndlp via elsiocb->context1 = lpfc_nlp_get(ndlp) before returning elsiocb.
Calling lpfc_nlp_put(ndlp) right after lpfc_prep_els_iocb() in
lpfc_els_rsp_rls_acc() kept the IOCB's reference live when elsiocb was
non-NULL, and returned immediately without dereferencing ndlp when
elsiocb was NULL.

Commit 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference
taking") later removed lpfc_nlp_get(ndlp) from lpfc_prep_els_iocb() and
moved it to the end of lpfc_els_rsp_rls_acc(), while leaving the
lpfc_nlp_put(ndlp) call immediately after lpfc_prep_els_iocb().

Should the Fixes tag instead be:

  Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104025348.1527601-1-vulab@iscas.ac.cn?part=1