[PATCH] scsi: lpfc: fix ndlp use-after-free in RLS accept callback

[PATCH] scsi: lpfc: fix ndlp use-after-free in RLS accept callback

[Wentao Liang]

lpfc_els_rcv_rls() takes a reference on the ndlp for the pending
MBX_READ_LNK_STAT command.  lpfc_els_rsp_rls_acc() drops that
reference right after building the ACC IOCB, but then keeps
dereferencing ndlp in the trace message and takes a fresh reference
for the IOCB.

The node can be removed from the nodelist while the mailbox is
pending, so the put may be the last one and release ndlp through
lpfc_nlp_release().  The later ndlp->vport, ndlp->nlp_DID and
lpfc_nlp_get() calls then touch freed memory.

Move the put after the reference for the IOCB has been acquired, and
release it on the paths that bail out before that point.

Fixes: 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS commands")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/lpfc/lpfc_els.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 804aa7509b69..0bd706b1520f 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -8778,10 +8778,8 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 				     lpfc_max_els_tries, ndlp,
 				     ndlp->nlp_DID, ELS_CMD_ACC);
 
-	/* Decrement the ndlp reference count from previous mbox command */
-	lpfc_nlp_put(ndlp);
-
 	if (!elsiocb) {
+		lpfc_nlp_put(ndlp);
 		mempool_free(pmb, phba->mbox_mem_pool);
 		return;
 	}
@@ -8821,10 +8819,14 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 	phba->fc_stat.elsXmitACC++;
 	elsiocb->ndlp = lpfc_nlp_get(ndlp);
 	if (!elsiocb->ndlp) {
+		lpfc_nlp_put(ndlp);
 		lpfc_els_free_iocb(phba, elsiocb);
 		return;
 	}
 
+	/* Decrement the ndlp reference count from previous mbox command */
+	lpfc_nlp_put(ndlp);
+
 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);
 	if (rc == IOCB_ERROR) {
 		lpfc_els_free_iocb(phba, elsiocb);
-- 
2.34.1

Re: [PATCH] scsi: lpfc: fix ndlp use-after-free in RLS accept callback

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:53:48 +0000, Wentao Liang wrote:
> lpfc_els_rcv_rls() takes a reference on the ndlp for the pending
> MBX_READ_LNK_STAT command.  lpfc_els_rsp_rls_acc() drops that
> reference right after building the ACC IOCB, but then keeps
> dereferencing ndlp in the trace message and takes a fresh reference
> for the IOCB.
> 
> The node can be removed from the nodelist while the mailbox is
> pending, so the put may be the last one and release ndlp through
> lpfc_nlp_release().  The later ndlp->vport, ndlp->nlp_DID and
> lpfc_nlp_get() calls then touch freed memory.
> 
> Move the put after the reference for the IOCB has been acquired, and
> release it on the paths that bail out before that point.
> 
> Fixes: 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS commands")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/scsi/lpfc/lpfc_els.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] scsi: lpfc: fix ndlp use-after-free in RLS accept callback

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] scsi: lpfc: inaccurate Fixes tag in commit message for lpfc_els_rsp_rls_acc()
--

commit 8109741dc29cffda7f87382c25b20f6a9dd30b92
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: lpfc: fix ndlp use-after-free in RLS accept callback

This commit fixes a use-after-free of ndlp in lpfc_els_rsp_rls_acc() by
delaying lpfc_nlp_put(ndlp) until after the IOCB reference on ndlp has
been acquired, and releasing it on earlier error paths.

>     scsi: lpfc: fix ndlp use-after-free in RLS accept callback
>     
>     lpfc_els_rcv_rls() takes a reference on the ndlp for the pending
>     MBX_READ_LNK_STAT command.  lpfc_els_rsp_rls_acc() drops that
>     reference right after building the ACC IOCB, but then keeps
>     dereferencing ndlp in the trace message and takes a fresh reference
>     for the IOCB.
>     
>     The node can be removed from the nodelist while the mailbox is
>     pending, so the put may be the last one and release ndlp through
>     lpfc_nlp_release().  The later ndlp->vport, ndlp->nlp_DID and
>     lpfc_nlp_get() calls then touch freed memory.
>     
>     Move the put after the reference for the IOCB has been acquired, and
>     release it on the paths that bail out before that point.
>     
>     Fixes: 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS commands")
>     Cc: stable@vger.kernel.org
>     Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>     Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

[Severity: Low]
In commit 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS
commands"), lpfc_prep_els_iocb() itself acquired the IOCB reference on
ndlp via elsiocb->context1 = lpfc_nlp_get(ndlp) before returning elsiocb.
Calling lpfc_nlp_put(ndlp) right after lpfc_prep_els_iocb() in
lpfc_els_rsp_rls_acc() kept the IOCB's reference live when elsiocb was
non-NULL, and returned immediately without dereferencing ndlp when
elsiocb was NULL.

Commit 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference
taking") later removed lpfc_nlp_get(ndlp) from lpfc_prep_els_iocb() and
moved it to the end of lpfc_els_rsp_rls_acc(), while leaving the
lpfc_nlp_put(ndlp) call immediately after lpfc_prep_els_iocb().

Should the Fixes tag instead be:

  Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104025348.1527601-1-vulab@iscas.ac.cn?part=1