[PATCH 04/10] lpfc: Add REG_VFI mailbox cmd error handling

[Justin Tee <justintee8345@gmail.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 5122 bytes --]

If lpfc_issue_reg_vfi() returns an error in lpfc_rcv_plogi(), then
execution of lpfc_rcv_plogi() continues and lpfc_reg_rpi() is called, which
allocates an mbuf.  When this REG_RPI mailbox is issued, it inevitably
fails because the VFI is not registered.  However, the REG_RPI failure does
not free the mbuf that was allocated in lpfc_reg_rpi() because there is no
check for mbox error status in lpfc_defer_plogi_acc().

Fix by adding a check in lpfc_rcv_plogi() if lpfc_reg_vfi() fails, then
exit early.  Also, add mailbox status check in lpfc_defer_plogi_acc to
enter the REG_RPI mbox_cmpl functions and free the allocated mbuf.

Signed-off-by: Justin Tee <justintee8345@gmail.com>
---
 drivers/scsi/lpfc/lpfc_nportdisc.c | 38 ++++++++++++++++--------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 5e431928de0b..9c449055a55e 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1,7 +1,7 @@
 /*******************************************************************
  * This file is part of the Emulex Linux Device Driver for         *
  * Fibre Channel Host Bus Adapters.                                *
- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term *
+ * Copyright (C) 2017-2026 Broadcom. All Rights Reserved. The term *
  * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.     *
  * Copyright (C) 2004-2016 Emulex.  All rights reserved.           *
  * EMULEX and SLI are trademarks of Emulex.                        *
@@ -316,8 +316,7 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
 	struct lpfc_iocbq *save_iocb;
 	struct lpfc_nodelist *ndlp;
 	MAILBOX_t *mb = &login_mbox->u.mb;
-
-	int rc;
+	int rc = 0;
 
 	ndlp = login_mbox->ctx_ndlp;
 	save_iocb = login_mbox->ctx_u.save_iocb;
@@ -346,7 +345,7 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
 	 * completes.  This ensures, in Pt2Pt, that the PLOGI LS_ACC is sent
 	 * before the PRLI.
 	 */
-	if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) {
+	if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag) || mb->mbxStatus || rc) {
 		/* Now process the REG_RPI cmpl */
 		lpfc_mbx_cmpl_reg_login(phba, login_mbox);
 		clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
@@ -525,13 +524,13 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 		/* Issue CONFIG_LINK for SLI3 or REG_VFI for SLI4,
 		 * to account for updated TOV's / parameters
 		 */
-		if (phba->sli_rev == LPFC_SLI_REV4)
-			lpfc_issue_reg_vfi(vport);
-		else {
+		if (phba->sli_rev == LPFC_SLI_REV4) {
+			rc = lpfc_issue_reg_vfi(vport);
+		} else {
 			link_mbox = mempool_alloc(phba->mbox_mem_pool,
 						  GFP_KERNEL);
 			if (!link_mbox)
-				goto out;
+				goto rsp_rjt;
 			lpfc_config_link(phba, link_mbox);
 			link_mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
 			link_mbox->vport = vport;
@@ -544,11 +543,13 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 			rc = lpfc_sli_issue_mbox(phba, link_mbox, MBX_NOWAIT);
 			if (rc == MBX_NOT_FINISHED) {
 				mempool_free(link_mbox, phba->mbox_mem_pool);
-				goto out;
+				goto rsp_rjt;
 			}
 		}
 
 		lpfc_can_disctmo(vport);
+		if (rc)
+			goto rsp_rjt;
 	}
 
 	clear_bit(NLP_SUPPRESS_RSP, &ndlp->nlp_flag);
@@ -562,11 +563,11 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 
 	login_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
 	if (!login_mbox)
-		goto out;
+		goto rsp_rjt;
 
 	save_iocb = kzalloc_obj(*save_iocb);
 	if (!save_iocb)
-		goto out;
+		goto free_login_mbox;
 
 	/* Save info from cmd IOCB to be used in rsp after all mbox completes */
 	memcpy((uint8_t *)save_iocb, (uint8_t *)cmdiocb,
@@ -586,7 +587,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	rc = lpfc_reg_rpi(phba, vport->vpi, remote_did,
 			    (uint8_t *)sp, login_mbox, ndlp->nlp_rpi);
 	if (rc)
-		goto out;
+		goto free_save_iocb;
 
 	login_mbox->mbox_cmpl = lpfc_mbx_cmpl_reg_login;
 	login_mbox->vport = vport;
@@ -659,7 +660,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	login_mbox->mbox_cmpl = lpfc_defer_plogi_acc;
 	login_mbox->ctx_ndlp = lpfc_nlp_get(ndlp);
 	if (!login_mbox->ctx_ndlp)
-		goto out;
+		goto free_save_iocb;
 
 	login_mbox->ctx_u.save_iocb = save_iocb; /* For PLOGI ACC */
 
@@ -670,16 +671,17 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	rc = lpfc_sli_issue_mbox(phba, login_mbox, MBX_NOWAIT);
 	if (rc == MBX_NOT_FINISHED) {
 		lpfc_nlp_put(ndlp);
-		goto out;
+		goto free_save_iocb;
 	}
 	lpfc_nlp_set_state(vport, ndlp, NLP_STE_REG_LOGIN_ISSUE);
 
 	return 1;
-out:
-	kfree(save_iocb);
-	if (login_mbox)
-		mempool_free(login_mbox, phba->mbox_mem_pool);
 
+free_save_iocb:
+	kfree(save_iocb);
+free_login_mbox:
+	mempool_free(login_mbox, phba->mbox_mem_pool);
+rsp_rjt:
 	stat.un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC;
 	stat.un.b.lsRjtRsnCodeExp = LSEXP_OUT_OF_RESOURCE;
 	lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb, ndlp, NULL);
-- 
2.38.0