Hello James Smart,
The patch 692e5d73a811: "scsi: elx: efct: LIO backend interface
routines" from Jun 1, 2021, leads to the following static checker
warning:
drivers/scsi/elx/efct/efct_lio.c:851 efct_lio_npiv_make_nport()
warn: '&vport_list->list_entry' not removed from list
drivers/scsi/elx/efct/efct_lio.c
828 vport_list = kzalloc(sizeof(*vport_list), GFP_KERNEL);
829 if (!vport_list) {
830 kfree(lio_vport);
831 return ERR_PTR(-ENOMEM);
832 }
833
834 vport_list->lio_vport = lio_vport;
835 spin_lock_irqsave(&efct->tgt_efct.efct_lio_lock, flags);
836 INIT_LIST_HEAD(&vport_list->list_entry);
837 list_add_tail(&vport_list->list_entry, &efct->tgt_efct.vport_list);
^^^^^^^^^^^^^^^^^^^^^^
Is it possible to add this to the list after fc_vport_create() succeeds?
838 spin_unlock_irqrestore(&efct->tgt_efct.efct_lio_lock, flags);
839
840 memset(&vport_id, 0, sizeof(vport_id));
841 vport_id.port_name = npiv_wwpn;
842 vport_id.node_name = npiv_wwnn;
843 vport_id.roles = FC_PORT_ROLE_FCP_INITIATOR;
844 vport_id.vport_type = FC_PORTTYPE_NPIV;
845 vport_id.disable = false;
846
847 new_fc_vport = fc_vport_create(efct->shost, 0, &vport_id);
848 if (!new_fc_vport) {
849 efc_log_err(efct, "fc_vport_create failed\n");
850 kfree(lio_vport);
851 kfree(vport_list);
In the corrent code we free it without removing it from the list which
leads to a use after free.
852 return ERR_PTR(-ENOMEM);
853 }
854
855 lio_vport->fc_vport = new_fc_vport;
856
857 return &lio_vport->vport_wwn;
858 }
regards,
dan carpenter
