[PATCH] scsi: cxgbit: drop the cnp reference when the close reply never comes

[PATCH] scsi: cxgbit: drop the cnp reference when the close reply never comes

[Wentao Liang]

__cxgbit_free_cdev_np() takes a reference on the cxgbit_np before asking
firmware to remove the server socket, and cxgbit_close_listsrv_rpl()
drops it when the reply arrives.  cxgbit_wait_for_reply() can also give
up before any reply is received: it returns -EIO straight away when
CXGB4_STATE_START_RECOVERY or CXGB4_STATE_DETACH has cleared
CDEV_STATE_UP while the request was in flight.  That path is not the
-ETIMEDOUT path, so the function continues, frees the server TID and
returns without dropping the reference.  As the TID is gone, the reply
handler can no longer look the cxgbit_np up and the reference is leaked,
keeping the np allocation alive forever.

Tell the two -EIO sources apart with completion_done():
cxgbit_close_listsrv_rpl() completes wr_wait before it drops the
reference, so a finished completion means the reply owns it.  If the
wait gave up without a reply, drop the reference locally once the TID
has been freed.

Fixes: 9730ffcb8957 ("cxgbit: add files for cxgbit.ko")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/target/iscsi/cxgbit/cxgbit_cm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index 146705845fa3..91787bca3ff1 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -558,6 +558,15 @@ __cxgbit_free_cdev_np(struct cxgbit_device *cdev, struct cxgbit_np *cnp)
 
 	cxgb4_free_stid(cdev->lldi.tids, stid,
 			cnp->com.local_addr.ss_family);
+
+	/*
+	 * A reply carrying an error status also returns -EIO, but that reply
+	 * has already dropped the reference taken above.  Only a wait that
+	 * bailed out before any reply arrived still holds it.
+	 */
+	if (ret && !completion_done(&cnp->com.wr_wait.completion))
+		cxgbit_put_cnp(cnp);
+
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH] scsi: cxgbit: drop the cnp reference when the close reply never comes

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] scsi: cxgbit: double cxgbit_put_cnp() and UAF in __cxgbit_free_cdev_np()
--

commit 6bb8ef7c81c63dadb738bb34808599917602fb9c
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: cxgbit: drop the cnp reference when the close reply never comes

This commit attempts to fix a reference leak on struct cxgbit_np in
__cxgbit_free_cdev_np() when cxgbit_wait_for_reply() returns an error before
a firmware reply arrives, using completion_done() to check whether
cxgbit_close_listsrv_rpl() already handled the reply and dropped the
reference.

> diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
> index 146705845fa3e..91787bca3ff10 100644
> --- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
> +++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
> @@ -558,6 +558,15 @@ __cxgbit_free_cdev_np(struct cxgbit_device *cdev, struct cxgbit_np *cnp)
>  
>  	cxgb4_free_stid(cdev->lldi.tids, stid,
>  			cnp->com.local_addr.ss_family);
> +
> +	/*
> +	 * A reply carrying an error status also returns -EIO, but that reply
> +	 * has already dropped the reference taken above.  Only a wait that
> +	 * bailed out before any reply arrived still holds it.
> +	 */
> +	if (ret && !completion_done(&cnp->com.wr_wait.completion))
> +		cxgbit_put_cnp(cnp);

[Severity: Critical]
Does completion_done() work as expected here after
wait_for_completion_timeout() has returned?

When CPL_CLOSE_LISTSRV_RPL arrives with a non-zero status,
cxgbit_close_listsrv_rpl() wakes the waiter and unconditionally drops the
reference taken by __cxgbit_free_cdev_np():

drivers/target/iscsi/cxgbit/cxgbit_cm.c:cxgbit_close_listsrv_rpl() {
	...
	cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
	cxgbit_put_cnp(cnp);
}

Inside cxgbit_wake_up(), wr_waitp->ret is set to -EIO and complete()
(rather than complete_all()) increments completion.done from 0 to 1:

drivers/target/iscsi/cxgbit/cxgbit_cm.c:cxgbit_wake_up() {
	if (ret == CPL_ERR_NONE)
		wr_waitp->ret = 0;
	else
		wr_waitp->ret = -EIO;
	...
	complete(&wr_waitp->completion);
}

When wait_for_completion_timeout() in cxgbit_wait_for_reply() wakes up,
do_wait_for_common() consumes that completion by decrementing completion.done
back to 0 before returning -EIO. Because completion.done is 0 again,
completion_done(&cnp->com.wr_wait.completion) always returns false on this
path.

Wouldn't __cxgbit_free_cdev_np() then call cxgbit_put_cnp(cnp) a second time,
dropping the caller's reference and freeing cnp before cxgbit_free_np()
accesses cnp->np_accept_lock, drains cnp->np_accept_list, and calls
cxgbit_put_cnp(cnp) again?

Also, if CDEV_STATE_UP is cleared while the CPL_CLOSE_LISTSRV_REQ is already
in flight, cxgbit_wait_for_reply() returns -EIO immediately without waiting.
If cxgbit_close_listsrv_rpl() on another CPU looks up cnp via lookup_stid()
just before cxgb4_free_stid() clears the stid entry, can
__cxgbit_free_cdev_np() observe !completion_done() before
cxgbit_close_listsrv_rpl() reaches complete(), causing both paths to call
cxgbit_put_cnp(cnp) and triggering a use-after-free in
cxgbit_close_listsrv_rpl() and cxgbit_free_np()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104021448.1468404-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] scsi: cxgbit: drop the cnp reference when the close reply never comes

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:14:48 +0000, Wentao Liang wrote:
> __cxgbit_free_cdev_np() takes a reference on the cxgbit_np before asking
> firmware to remove the server socket, and cxgbit_close_listsrv_rpl()
> drops it when the reply arrives.  cxgbit_wait_for_reply() can also give
> up before any reply is received: it returns -EIO straight away when
> CXGB4_STATE_START_RECOVERY or CXGB4_STATE_DETACH has cleared
> CDEV_STATE_UP while the request was in flight.  That path is not the
> -ETIMEDOUT path, so the function continues, frees the server TID and
> returns without dropping the reference.  As the TID is gone, the reply
> handler can no longer look the cxgbit_np up and the reference is leaked,
> keeping the np allocation alive forever.
> 
> Tell the two -EIO sources apart with completion_done():
> cxgbit_close_listsrv_rpl() completes wr_wait before it drops the
> reference, so a finished completion means the reply owns it.  If the
> wait gave up without a reply, drop the reference locally once the TID
> has been freed.
> 
> Fixes: 9730ffcb8957 ("cxgbit: add files for cxgbit.ko")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/target/iscsi/cxgbit/cxgbit_cm.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof