Re: [PATCH v6 2/8] lpfc: Early return out of lpfc_els_abort when HBA_SETUP flag is not set

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: lpfc: lockless HBA_SETUP check leaves TOCTOU Use-After-Free race on pring
--

commit b6474390ac6cffa345174f9e11e10a15b8a091a7
Author: Nigel Kirkland <nkirkland2304@gmail.com>

lpfc: Early return out of lpfc_els_abort when HBA_SETUP flag is not set

This commit adds an early check on the HBA_SETUP flag in lpfc_els_abort()
to avoid using a stale ELS pring pointer during an HBA reset.

> diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
> index 9c449055a55e6..2c8d995a45bf8 100644
> --- a/drivers/scsi/lpfc/lpfc_nportdisc.c
> +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
> @@ -227,6 +227,11 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
>  	struct lpfc_iocbq *iocb, *next_iocb;
>  	int retval = 0;
>  
> +	/* Exit early to prevent race with queue teardown. */
> +	if (unlikely(phba->sli_rev == LPFC_SLI_REV4 &&
> +		     !test_bit(HBA_SETUP, &phba->hba_flag)))
> +		return;
> +

[Severity: High]
Does this lockless check leave a time-of-check to time-of-use race window
that can still result in a use-after-free on the pring pointer?

If a dev_loss_tmo callback executing lpfc_els_abort() is running
concurrently with an HBA reset, could this sequence occur:

CPU1 (dev_loss_tmo)
lpfc_els_abort()
  test_bit(HBA_SETUP, &phba->hba_flag) // returns true
  pring = lpfc_phba_elsring(phba);

CPU2 (HBA reset)
lpfc_sli_brdrestart_s4()
  clear_bit(HBA_SETUP, &phba->hba_flag);
  lpfc_sli4_queue_unset(phba);
    lpfc_wq_destroy(wq);
      kfree(wq->pring);

CPU1
  spin_lock_irq(&phba->hbalock);
  spin_lock(&pring->ring_lock); // use-after-free on stale pring pointer

Should the check and the subsequent usage of pring be synchronized against
the queue teardown path?

>  	pring = lpfc_phba_elsring(phba);
>  
>  	/* In case of error recovery path, we might have a NULL pring here */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013001648.62289-1-nkirkland2304@gmail.com?part=2