[REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[Alexander Antonakakis]

Hello,

Since 6.1.178, servers with an Emulex SLI-4 Fibre Channel HBA hang
during boot when the lpfc driver initializes. 6.1.177 works.
6.1.180, 6.1.187 and 6.1.190 (Debian 12 kernels 6.1.0-52 to -54)
all hang in the same way.

Hardware:
   Emulex LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter
   Firmware 14.4.322.17, sli-4:2:c
   lpfc 14.2.0.7

The cause appears to be the 6.1.y backport of:

299f5baa1321 ("scsi: lpfc: Fix memory leak in 
lpfc_sli4_driver_resource_setup()")

upstream commit 1bd28625e25be549ee7c47532e7c3ef91c682410

In mainline, the new mempool_free(mboxq, ...) is placed after the
call to lpfc_get_sli4_parameters(phba, mboxq) and its error check.
In the 6.1.y backport it landed before that call. In
drivers/scsi/lpfc/lpfc_init.c at v6.1.178:

8178:  mempool_free(mboxq, phba->mbox_mem_pool);
8187:  rc = lpfc_get_sli4_parameters(phba, mboxq);
8200:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */
8207:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */

So mboxq is freed, then used for a mailbox command to the HBA
(use-after-free), and may be freed again on the error paths
(double free). This runs on every SLI-4 HBA probe, which matches
the hang about 2 seconds into boot.

Moving the mempool_free() at line 8178 to after the
lpfc_get_sli4_parameters() call and its error handling, as in
mainline, should fix it. Other stable branches that took this
backport may be worth checking for the same placement.

Downstream report: https://bugs.debian.org/1151377

#regzbot introduced: 299f5baa1321a0951cc3ebbacc72b67433a65391

This is a production server, so I can only test during maintenance
windows, but I am happy to test a fix.

Regards,
Alexander Antonakakis

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr

--
Διευκρίνιση ηλεκτρονικού ταχυδρομείου
Οι πληροφορίες που συμπεριλαμβάνονται σε αυτό το μήνυμα είναι εμπιστευτικές και η χρήση τους
επιτρέπεται μόνον από τον αναφερόμενο παραλήπτη. Εάν έχετε λάβει το παρόν μήνυμα από λάθος και δεν
είστε ο προοριζόμενος παραλήπτης, σας ενημερώνουμε ότι αποκάλυψη, αναπαραγωγή, διανομή ή οποιασδήποτε
άλλης μορφής χρήση των περιεχομένων του παρόντος μηνύματος απαγορεύεται. Επίσης παρακαλείσθε να
αποστείλετε το αρχικό μήνυμα στην διεύθυνση του αποστολέα, καθώς και στη συνέχεια να διαγράψετε το
μήνυμα από το σύστημά σας.
Η επικοινωνία μέσω Internet δεν είναι ασφαλής και επομένως το ΜΑΙΧ δεν φέρει ευθύνη για οποιαδήποτε
θετική ή αποθετική ζημιά που προκλήθηκε από την χρήση του παρόντος ή των συνημμένων του λόγω ιών που
έχουν περάσει σε αυτά.

Email Disclaimer
The information in this email is confidential and is intended solely for the addressee(s). If you have
received this transmission in error, and you are not an intended recipient, be aware that any
disclosure, copying, distribution or use of this transmission or its contents is prohibited.
Furthermore, you are kindly requested to send us back the original message to the sender’s address and
delete the message from your system immediately.
Internet communications are not secure and therefore MAICh does not accept legal responsibility for the
contents of this message and for any damage whatsoever that is caused by viruses being passed.

Re: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[Andrey Misiurov]

On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
> Moving the mempool_free() at line 8178 to after the
> lpfc_get_sli4_parameters() call and its error handling, as in
> mainline, should fix it.

Hi Alexander,

This looks like the same issue I came across. A patch doing exactly
that is already queued for the next 6.1.y release:

https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com

Regards,
Andrey

Re: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[Alexander Antonakakis]

#regzbot link: 
https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com

On 10/20/26 14:39, Andrey Misiurov wrote:
> On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
>> Moving the mempool_free() at line 8178 to after the
>> lpfc_get_sli4_parameters() call and its error handling, as in
>> mainline, should fix it.
> 
> Hi Alexander,
> 
> This looks like the same issue I came across. A patch doing exactly
> that is already queued for the next 6.1.y release:
> 
> https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com
> 
> Regards,
> Andrey

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr

Re: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

[Greg KH]

On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
> 
> Hello,
> 
> Since 6.1.178, servers with an Emulex SLI-4 Fibre Channel HBA hang
> during boot when the lpfc driver initializes. 6.1.177 works.
> 6.1.180, 6.1.187 and 6.1.190 (Debian 12 kernels 6.1.0-52 to -54)
> all hang in the same way.
> 
> Hardware:
>    Emulex LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter
>    Firmware 14.4.322.17, sli-4:2:c
>    lpfc 14.2.0.7
> 
> The cause appears to be the 6.1.y backport of:
> 
> 299f5baa1321 ("scsi: lpfc: Fix memory leak in 
> lpfc_sli4_driver_resource_setup()")
> 
> upstream commit 1bd28625e25be549ee7c47532e7c3ef91c682410
> 
> In mainline, the new mempool_free(mboxq, ...) is placed after the
> call to lpfc_get_sli4_parameters(phba, mboxq) and its error check.
> In the 6.1.y backport it landed before that call. In
> drivers/scsi/lpfc/lpfc_init.c at v6.1.178:
> 
> 8178:  mempool_free(mboxq, phba->mbox_mem_pool);
> 8187:  rc = lpfc_get_sli4_parameters(phba, mboxq);
> 8200:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */
> 8207:  mempool_free(mboxq, phba->mbox_mem_pool);  /* error path */
> 
> So mboxq is freed, then used for a mailbox command to the HBA
> (use-after-free), and may be freed again on the error paths
> (double free). This runs on every SLI-4 HBA probe, which matches
> the hang about 2 seconds into boot.
> 
> Moving the mempool_free() at line 8178 to after the
> lpfc_get_sli4_parameters() call and its error handling, as in
> mainline, should fix it. Other stable branches that took this
> backport may be worth checking for the same placement.

Great, can you send a fix for this?

thanks,

greg k-h