Re: [PATCH 6.1.y] scsi: lpfc: Fix use-after-free of mboxq in lpfc_sli4_driver_resource_setup()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: lpfc: Double free / UAF of mboxq on mailbox timeout in lpfc_get_sli4_parameters()
--

commit 7386b919d763fc6f447906aaee405cec863dac39
Author: Andrey Misiurov <andrey.misyrov@gmail.com>

scsi: lpfc: Fix use-after-free of mboxq in lpfc_sli4_driver_resource_setup()

This commit moves the mempool_free() of mboxq in 
lpfc_sli4_driver_resource_setup() after the error handling for 
lpfc_get_sli4_parameters() to fix a previous incorrect backport.

> diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
> index 13ebbe4a71c47..fc5a640b7f742 100644
> --- a/drivers/scsi/lpfc/lpfc_init.c
> +++ b/drivers/scsi/lpfc/lpfc_init.c
> @@ -8175,7 +8175,6 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
>  			}
>  		}
>  	}
> -	mempool_free(mboxq, phba->mbox_mem_pool);
>  
>  	lpfc_nvme_mod_param_dep(phba);
>  

[ ... ]

> @@ -8209,6 +8208,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
>  			goto out_free_bsmbx;
>  		}
>  	}
> +	mempool_free(mboxq, phba->mbox_mem_pool);

[Severity: High]
Does this unconditionally free mboxq even when lpfc_get_sli4_parameters()
encounters a timeout?

If the mailbox command issued by lpfc_get_sli4_parameters() times out, it
returns MBX_TIMEOUT. On this path, the driver retains the mboxq and 
delegates cleanup to the asynchronous completion handler:

drivers/scsi/lpfc/lpfc_sli.c:lpfc_sli_issue_mbox_wait() {
    ...
		} else {
			retval = MBX_TIMEOUT;
			pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
		}
    ...
}

Because mboxq is freed unconditionally here on the success path (and also
on the error goto paths above this), could this lead to a double-free and
use-after-free when the async handler later attempts to clean it up?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008184328.2857037-1-andrey.misyrov@gmail.com?part=1