Two small fixes to the NVMe/FC transport path added in commit 5efdd5cf9281
("scsi: fnic: Add the NVMe/FC transport path"), both found by reading the
code rather than by hitting them on hardware. They apply to
scsi/for-next, since that code is not in mainline yet.
Patch 1 initializes struct nvme_fc_port_info in nvfnic_add_lport().
dev_loss_tmo is currently left uninitialized on the stack. The transport
does not read it for a local port, so this is hygiene rather than a
behaviour fix, and it carries no Fixes tag; nvfnic_add_tport() right below
already memsets its own copy.
Patch 2 moves the kfree() of iport->nv_tmpl out of nvfnic_nvme_unload()
and into nvfnic_local_port_delete(). The template is what the transport
stores in lport->ops, and nvme_fc_unregister_localport() only calls
->localport_delete() inline when no active remote ports are left;
otherwise the call is deferred to nvme_fc_rport_inactive_on_lport(),
which dereferences lport->ops after the unregister has returned. Today
the driver frees the template even when the removal wait times out, which
leaves the transport with a dangling ->ops.
Note that patch 2 only narrows that one use-after-free. The rest of the
timeout path still tears the fnic down while the transport holds
lport->private == iport, so that path may deserve a wider look; I did not
want to fold that into a fix.
Patch 2's reasoning rests on the NVMe/FC transport's lifetime rules, so
linux-nvme and the FC transport maintainers are copied for a second
opinion on that argument.
Compile-tested only (allmodconfig, W=1, drivers/scsi/fnic/ clean). I do
not have Cisco VIC hardware, so neither patch has been tested on a live
adapter.
Linmao Li (2):
scsi: fnic: initialize the NVMe local port info before registering
scsi: fnic: free the NVMe port template from the delete callback
drivers/scsi/fnic/fnic_nvme.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
base-commit: 30733f28c0347d237ffb5333fdfab7a9a2d4ed34
--
2.25.1