[bug report] scsi: elx: libefc: SLI and FC PORT state machine interfaces

[bug report] scsi: elx: libefc: SLI and FC PORT state machine interfaces

[Dan Carpenter]

Hello James Smart,

The patch fcd427303eb9: "scsi: elx: libefc: SLI and FC PORT state
machine interfaces" from Jun 1, 2021, leads to the following Smatch
static checker warning:

	drivers/scsi/elx/libefc/efc_nport.c:710 efc_nport_vport_del()
	warn: 'nport' was already freed.

drivers/scsi/elx/libefc/efc_nport.c
    680 int
    681 efc_nport_vport_del(struct efc *efc, struct efc_domain *domain,
    682                     u64 wwpn, uint64_t wwnn)
    683 {
    684         struct efc_nport *nport;
    685         struct efc_vport *vport;
    686         struct efc_vport *next;
    687         unsigned long flags = 0;
    688 
    689         spin_lock_irqsave(&efc->vport_lock, flags);
    690         /* walk the efc_vport_list and remove from there */
    691         list_for_each_entry_safe(vport, next, &efc->vport_list, list_entry) {
    692                 if (vport->wwpn == wwpn && vport->wwnn == wwnn) {
    693                         list_del(&vport->list_entry);
    694                         kfree(vport);
    695                         break;
    696                 }
    697         }
    698         spin_unlock_irqrestore(&efc->vport_lock, flags);
    699 
    700         if (!domain) {
    701                 /* No domain means no nport to look for */
    702                 return 0;
    703         }
    704 
    705         spin_lock_irqsave(&efc->lock, flags);
    706         list_for_each_entry(nport, &domain->nport_list, list_entry) {
    707                 if (nport->wwpn == wwpn && nport->wwnn == wwnn) {
    708                         kref_put(&nport->ref, nport->release);
                                                      ^^^^^^^^^^^^^^
The release function can free "nport".

    709                         /* Shutdown this NPORT */
--> 710                         efc_sm_post_event(&nport->sm, EFC_EVT_SHUTDOWN, NULL);
                                                  ^^^^^^^^^^
Use after free.

    711                         break;
    712                 }
    713         }
    714 
    715         spin_unlock_irqrestore(&efc->lock, flags);
    716         return 0;
    717 }

regards,
dan carpenter