Re: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
> 
> Hello,
> 
> Since 6.1.178, servers with an Emulex SLI-4 Fibre Channel HBA hang
> during boot when the lpfc driver initializes. 6.1.177 works.
> 6.1.180, 6.1.187 and 6.1.190 (Debian 12 kernels 6.1.0-52 to -54)
> all hang in the same way.
> 
> Hardware:
>    Emulex LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter
>    Firmware 14.4.322.17, sli-4:2:c
>    lpfc 14.2.0.7
> 
> The cause appears to be the 6.1.y backport of:
> 
> 299f5baa1321 ("scsi: lpfc: Fix memory leak in 
> lpfc_sli4_driver_resource_setup()")
> 
> upstream commit 1bd28625e25be549ee7c47532e7c3ef91c682410
> 
> In mainline, the new mempool_free(mboxq, ...) is placed after the
> call to lpfc_get_sli4_parameters(phba, mboxq) and its error check.
> In the 6.1.y backport it landed before that call. In
> drivers/scsi/lpfc/lpfc_init.c at v6.1.178:
> 
> 8178:  mempool_free(mboxq, phba->mbox_mem_pool);
> 8187:  rc = lpfc_get_sli4_parameters(phba, mboxq);
> 8200:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */
> 8207:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */
> 
> So mboxq is freed, then used for a mailbox command to the HBA
> (use-after-free), and may be freed again on the error paths
> (double free). This runs on every SLI-4 HBA probe, which matches
> the hang about 2 seconds into boot.
> 
> Moving the mempool_free() at line 8178 to after the
> lpfc_get_sli4_parameters() call and its error handling, as in
> mainline, should fix it. Other stable branches that took this
> backport may be worth checking for the same placement.

Great, can you send a fix for this?

thanks,

greg k-h