On Wed, 29 Jul 2020 19:10:11 -0400, Ewan D. Milne wrote:
> We cannot wait on a completion object in the lpfc_nvme_targetport structure
> in the _destroy_targetport() code path because the NVMe/fc transport will
> free that structure immediately after the .targetport_delete() callback.
> This results in a use-after-free, and a crash if slub_debug=FZPU is enabled.
>
> An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8
> ("scsi: lpfc: Correct localport timeout duration error") subsequently changed
> the code to reference the completion through a pointer in the object rather
> than the local stack variable. Fix this by using the stack variable directly.
Applied to 5.9/scsi-queue, thanks!
[1/1] scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
https://git.kernel.org/mkp/scsi/c/af6de8c60fe9
--
Martin K. Petersen Oracle Linux Engineering
